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MOBILITY: POTHOLES, RED 
LIGHTS, ONE-WAY STREETS 

Developers cope with detours on the 
road to portable enterprise apps 



BY EDWARD J. CORREIA 

Mobilizing enterprise applica- 
tions is rarely a seamless process. 
Despite vendor claims of sim- 
plicity — their market- 
ing often plays down 
complexities and pit- 
falls — the process is 
often long and tedious 
for developers, IT staff 
and end users. 

"The devil's in the 
details," said Rick 
Fleischman, director 
of product marketing Changes are always 
for business-to-busi- needed to make apps 
ness solutions at Blue work in small devices, 
Martini Software Inc., says IBM's Colson. 



sim- uon 



a software consultancy that in 
July began demonstrating a 
mobile version of its CRM solu- 
tion for mobile salespeople. 
"Any development 
task is harder than 
it looks, particularly 
when you're dealing 
with people who are 
sometimes connected 
and sometimes not." 

Blue Martini's main 
line of business is 
e-commerce solutions, 
and counts among its 
clients Kohl's, Levi 
Strauss & Co. and Saks 
► continued on page 19 



Sun to Port 
JES to HP-UX 
And Windows 

Multiplatform push might include AIX 



BY YVONNE L. LEE 

Sun Microsystems Inc. has be- 
gun shipping its Java Enterprise 
System on Linux, and in late July 
announced plans to ship the Java 
development and deployment 
platform on Microsoft Corp.'s 
Windows and Hewlett-Packard 
Co.'s HP-UX by the end of the 
first quarter of 2005. 

The move is designed to sell 
the Java Enterprise System 
(JES) into larger organizations 
that have heterogeneous com- 
puting environments, said 
Steve Borcich, executive direc- 
tor of marketing for the Java 
Enterprise System and security. 

Borcich said that smaller 
organizations have already pur- 
chased the renamed Sun ONE 
system, but that bigger organi- 
zations, which have a larger 
purchasing cycle, were just get- 
ting around to making buying 
decisions. 

"A lot of those bigger cus- 
tomers have heterogeneous 
environments. They want to see 



that we're committed to being 
multiplatform," he said. 

Offering JES on other 
platforms could make Sun 
more competitive, particularly 
against BEA Systems Inc. and 
IBM Corp., said Shawn Willett, 
principal analyst at Current 
Analysis Inc. "By porting it to 
these other platforms, they're 
more seriously making a play 
for the middleware market. You 
can't make a middleware mar- 
ket claim if you only run on 
your own hardware," he said. 

Sun also is considering port- 
ing JES to IBM's AIX, but Sun 
has found itself being consid- 
ered in more accounts that have 
both HP and Sun equipment 
than in those that have both 
Sun and IBM equipment, said 
Borcich. 

"We haven't seen a lot of 
demand for [porting to AIX] . It 
has come up," he said, adding, 
"IBM has been putting a lot of 
emphasis on Linux. What's 
their commitment to AIX?" I 



UML: Too Big, Too Small, Just Right? 

Experts weigh in on what's ahead for the Unified Modeling Language 



BY JENNIFER DEJONG 

UML 2.0 is too fat. 

Modeling experts 
don't necessarily agree with 
the remark made by one of 
UML's own backers. But cou- 
pled with Microsoft Corp.'s 
recent plan to provide modeling 
tools, the provocative comment 
has sparked a discussion that's 
likely to benefit all parties 
involved: What is the best way 
to move the Unified Modeling 
Language forward, increasing 
its use among corporate develop- 
ment teams? 

"The language has become 



ANALYSIS 



obese," said Cris 
Kobryn, co-chair of the 
Analysis & Design Plat- 
form Task Force for Object Man- 
agement Group Inc., the non- 
profit industry consortium that 
oversees the UML specification. 
UML 2.0 includes 15 diagrams, 
but only six of them — Class, 



Sequence, Use Case, Activity, 
State Machine and Composite 
Structure — do the heavy lifting, 
said Kobryn, CEO of PivotPoint 
Technology Corp., a UML con- 
sulting firm, in Fallbrook, Calif. 
"We should have cut the fat." 

"I can't say I agree with 
that," countered Bran Selic, a 



distinguished engineer at IBM 
Corp. and co-chair of OMG's 
Finalization Task Force for 
UML 2.0 Infrastructure. "The 
technology has evolved to meet 
a problem set. And the prob- 
lems are becoming more and 
more complex." You can't solve 
► continued on page 12 



CODE BLOAT: SHOULD UML GO ON A DIET? 






We should have cut 
the fat. UML has 
become too obese. 

-Cris Kobryn, 
PivotPoint 



No, it hasn't. It's just 
that the problems are 
more complex. 

-Bran Selic, 
IBM 



UML diagrams still 
aren't closely tied to 
the source code. 
-Jack Greenfield, 
Microsoft 



Criticism is good, 
and developers will 
ultimately decide. 

-Jan Popkin, 
Popkin Software 
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Application Simulator 3.1 Generates, Links Code 

iRise claims Visio-like modeling environment works better with BEA Workshop 



BY EDWARD J. CORREIA 

A simpler interface and tighter 
integration with BE As Work- 
shop for Web Logic are the 
latest enhancements to Appli- 
cation Simulator 3.1, iRise 
Inc.'s graphical requirements 
simulation tool released in ear- 
ly August. 

According to Emmet Keeffe, 
iRise's co-founder and CEO, 
the primary benefit of Applica- 
tion Simulator, a US$250,000 
point-and-click modeling envi- 
ronment for business analysts to 
simulate applications before 
coding, is its appeal to 
nondevelopers. 

"Business people 
don't like text-based 
requirements docu- 
ments," he said, adding 
that the typical busi- 
ness analyst doesn't 
know HTML, can't 
work with Dream- 
Weaver or FrontPage 'Business people 
and certainly doesn't don't like text- 
know data modeling, based requirements 
"This is geared toward documents/ says 
somebody who knows iRise's Keeffe. 
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PowerPoint, Excel, Word 
and Visio. It's a simple, non- 
technical modeling envi- 
ronment in which a busi- 
ness analyst can create a 
functioning simulation." 

New in version 3.1, 
Keeffe said, is the ability 
to generate JavaServer 
Pages for BEA's WebLogic 
Workshop development 
environment, with page 
flow diagrams and automat- 
ic links from text require- 
ments to their appropriate 
JSPs. "This makes it easy 
for the develop- 
er to [use] the 
simulation; they 
can right-click 
on the text re- 
quirement and 
pop up the simulation 
to run through it 
before they start writ- 
ing code," he said. 

Keeffe asserts that 
visual tools are superi- 
or to text-based meth- 
ods of documenting 
requirements, which 
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The modeling environment creates simulations before any code is written, says the company. 



many people have a hard time 
interpreting and communicating 
to developers. "What happens 
is that IT builds the system and 
as soon as it's running and people 
start doing transactions, they 
start telling you what they really 
wanted." 

Such changes lead to late- 



cycle application rewrites, which 
are expensive. "And some pro- 
jects even fail based on that. 
This allows business analysts 
to give developers a visual simu- 
lation of exactly what the 
business users want that looks 
and functions like a real system. 
Then developers can go off 



j and write the code." 

Also new is the abili- 
ty to link code direct- 
ly to individual pieces 
of the simulation. "Now 
you have traceability 
and you can do change- 
impact analysis, so if 
somebody changes 
their mind later, the de- 
veloper can say which 
pieces of the simulation 
touch which pieces of 
code," and help accu- 
rately determine the 
time needed to perform 
the changes. 

Keeffe said iRise is 
positioning Application 
Simulator as a light- 
weight visual life-cycle 
solution that comple- 
ments BEA's Workshop, and as 
an alternative to similar solutions 
from Borland and IBM Rational. 
"It's hard to get those products 
adopted because they're com- 
plex and typically too hard for 
the business analyst to use." 
Application Simulator is avail- 
able now for Windows. I 



Busy Month for Burgeoning App Security Market 



BY JENNIFER DEJONG 

Activity was brisk in the appli- 
cation security market last 
month: Sanctum Inc. was 
acquired by a business manage- 
ment software company, and 
Kavado Inc. delivered new ver- 
sions of its Web application 
scanner and firewall products. 

On July 26, Watchfire Corp., 
in Waltham, Mass., announced 
it had acquired Santa Clara- 
based Sanctum for an undis- 
closed sum. With the sale, 
expected to close by the end of 
August, Watchfire acquired 
Sanctum's AppScan and App- 
Shield products, as well as the 
company's intellectual property. 

Watchfire said in a state- 
ment that it will continue to sell 
AppScan, which tests applica- 
tions for security breaches and 
recommends fixes, and App- 
Shield, a Web application fire- 
wall, as stand-alone products. 
But it also plans to integrate 
and extend the key capabilities 
of both in WebXM, its online 
business management software 
that helps track compliance 
with corporate security policies 
and regulatory agencies. 



A June 2003 report from Boston-based research firm The Yankee 
Group estimates the market for Web application security products 
and services was worth US$140 million in 2002, and predicts it 
will grow at a compound annual rate of 65 percent to $1.74 billion 
by 2007. 



KAVADO UPDATES OFFERINGS 

Sanctum competitor Kavado, in 
New York, announced in July the 
availability of ScanDo 2.5 and 
InterDo 3.5. ScanDo, which 
finds and helps fix holes that 
hackers could exploit in Web 
applications, and InterDo, a 
Web application firewall, can run 
as stand-alone products, but they 
are designed to work together, 
said Kavado's vice president of 
marketing, Jon Greene. 

"We are not just scanning 
the code. We are concerned 
with the entire infrastructure it 
is sitting on." ScanDo takes 
what it learns from a code scan 
and automatically generates 
security policies based on those 
findings, said Greene. 

For instance, if the scan 
detects the presence of SQL 
code in a Web request, it cre- 
ates a security policy that tells 
InterDo to block all SQL 
requests, except those it identi- 



fied as legitimate. The presence 
of SQL code can indicate a pos- 
sible "SQL injection" attack, a 
well-known vulnerability where 
a hacker maliciously alters a 
request to retrieve all records 
instead of just those he is en- 
titled to see. 

Previous versions of Scan- 
Do, which starts at US$11,000 
per scanned server, and Inter- 



Do, which costs $15,000 per 
application firewall, identified 
only two types of privileged 
data: credit-card and Social 
Security numbers. 

But the new versions let 
developers specify additional 
types, such as customer account 
numbers and patient data. They 
also provide a centralized 
repository, which consolidates 
results from both the scanner 
and firewall. 

"When you have a dozen 
developers scanning and tuning 
their code, managers need to 
see an aggregated version of the 



information," said Greene. It's 
important to have the big pic- 
ture, he said. 

New to InterDo is a feature 
that forces company insiders, not 
just outside traffic, to access the 
Web site through the firewall, 
said Greene. "Insiders know 
where the weaknesses are." 

In addition to Sanctum, 
Kavado competes with start-up 
app security vendor Fortify Soft- 
ware Inc., in Menlo Park, Calif. 
Other application security play- 
ers include Reasoning Inc., in 
Mountain View, Calif., and SPI 
Dynamics Inc., in Atlanta. I 



IBM SNAPS UP CYANEA 



BY ALAN ZEICHICK 

On the last business day of July, 
IBM Corp. announced its intent 
to acquire Cyanea Systems 
Corp., which sells tools for mon- 
itoring Web-based business 
applications. Cyanea, based in 
Oakland, Calif., is privately held; 
terms of the acquisition were 
not disclosed. 

According to Robert Le- 
Blanc, general manager of 



IBM's Application & Integration 
Middleware Division, Cyanea 
will be integrated into the com- 
pany's Tivoli business unit. This 
marks the 17th acquisition by 
the Tivoli group since 2001, with 
the largest recent move being 
the purchase of Candle Corp. 
earlier this year. 

Cyanea's flagship product, 
called Cyanea One, manages the 
deployments of large-scale J2EE 



applications, with an emphasis on 
those that interact with main- 
frame CICS transaction systems 
and IMS databases. There are 
currently two versions of the soft- 
ware: one for IBM's WebSphere, 
the other for BEA's WebLogic 
app server. It is unclear if the 
WebLogic version would be con- 
tinued after the acquisition is 
complete. 

Cyanea also sells WSAM, an 
application for managing Web- 
Sphere app servers running 
natively on z/OS and OS/390. I 
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ColdFusion to Go Beyond Web Pages 



BY EDWARD J. CORREIA 

When released in early 2005, 
the next edition of Macromedia 
Inc. s ColdFusion Web applica- 
tion server will include an exten- 
sible gateway architecture that 



will enable developers to use 
events like instant messaging 
and SMS to trigger actions, the 
company told SD Times as the 
product entered a second phase 
of alpha testing in late July 



"As a ColdFusion developer, 
you can now build applications 
for a limitless number of poten- 
tial Internet clients, not just 
Web browsers," said ColdFu- 
sion product manager Tim 



Buntel. The list of predevel- 
oped gateways to be included 
might also include FTP and 
Telnet. 

"ColdFusion could watch a 
directory in a filesystem and do 
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something if a file is created or 
deleted there," he said, such as 
add a record to a database, 
send an e-mail or run some 
other code. Developers also 
will be able to build their own 
gateways. "For example, if you 
wanted to create a socket gate- 
way, ColdFusion could listen 
on a TCP/IP port and take 
some action." 

Code-named Blackstone, the 
successor to ColdFusion MX 6.1 
also will permit the use of Flash 
to create, manage and present 
data-entry forms, something 
that is difficult today using Flash 
and ColdFusion as two separate 
products. 

"You can do it, but it's quite 
a bit of work," Buntel said, 
adding that a simple set of tags 
can now be used to create mul- 
tistep forms, accordion panes 
and tab controls. "And there are 
forms not available in HTML 
like calendars, tree controls and 
data grids." 

The software also gives devel- 
opers more control over field 
content validation, which can 
occur in the fields themselves, at 
the client, on the server or any 
combination of the three. 

Blackstone also will simplify 
packaging existing content for 
viewing and printing, Buntel 
claimed. "You don't have to cre- 
ate two versions — an HTML 
version and a PDF version. You 
can just wrap tags around exist- 
ing content and create printable 
PDF or FlashPaper documents 
with control over pagination, 
headers and footers." 

BUILT-IN REPORTING 

A new reporting engine that 
Buntel said is similar to that 
of BusinessObjects' Crystal 
Reports, is intended to help 
simplify the creation of data- 
driven applications. "You'll have 
a banded report interface with a 
query builder, calculated fields, 
repeating regions, subreports, 
charts and graphs." 

Buntel claimed that Black- 
stone developers will have an 
easier time taking advantage of 
J2EE's ability to launch multi- 
ple instances to improve relia- 
bility. "With previous versions, 
if anything went wrong with an 
application, it would bring 
down all of the apps. With mul- 
tiple instances, apps are com- 
pletely isolated; you get the 
benefit of multiple physical 
servers without the added 
expense and management costs 
of multiple machines." 

Blackstone is set to begin 
beta testing this fall. I 
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Meet Jetson: A Java IDE 

For Junior Programmers 



BY JENNIFER DEJONG 

Professional services firm Data- 
Source Inc. made its first foray 
into the tools market last 
month, announcing a prere- 
lease version of a Java IDE 
called Jetson. 

The Greenbelt, Md.-based 
company claims that Jetson is 
easier to use than competitive 
offerings from BE A, Borland 
and IBM. Web Logic Workshop, 
JBuilder and WebSphere Studio 
Application Developer are 
aimed at experienced Java devel- 
opers, but Jetson is geared pri- 
marily to novices who are famil- 
iar with only basic programming 
concepts, said DataSource's 
chief technology officer, Joe 
Brinkman. "They might have a 
background in Visual Basic or 
COBOL. Or they may know 
Java, but not J2EE." 

J2EE has grown into such a 
broad set of specifications that 
using it to develop good appli- 
cations is becoming more and 
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more complex, said Brinkman. 
Jetson shields less-experienced 
developers from that complexi- 
ty by automating repetitive 
tasks, such as creating Enter- 
prise JavaBeans (EJBs) that go 
against the database. "There is a 
lot of setup and teardown asso- 
ciated with that," he said. 

Because Jetson reduces the 
need to write code, DataSource 
believes that the IDE will also 
appeal to senior Java develop- 
ers who want to avoid labor- 
intensive tasks, such as deploy- 
ing a J2EE application. Doing 
that in competitors' offerings 
typically requires developers to 
write server- specific packages, 
said Brinkman. 

But Jetson does that work 
behind the scenes, enabling one- 
click deployment. It also lets 
developers access the code 
directly if they want to, noted 
Brinkman. A prerelease version 
of Jetson, which supports JBoss 
3.2.3, is available free of charge 
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at www.JetsonJ2ee.com. The 
completed product, available lat- 
er this year, will also support 
Web Logic 8.1 and 6.1 and Web- 
Sphere 5.1. Pricing will start at 
US$999 per developer, he said. 

Competitors attempt to 
address the complexity of their 
IDEs with wizards. But to use 
them effectively, you have 
to understand J2EE, said Brink- 
man. For instance, in J2EE 
there are two types of EJBs: con- 
tainer managed persistence 
(CMP) and bean-managed per- 
sistence (BMP), he said. 

"A wizard will say: 'CMP or 
BMP?' But if I'm not a J2EE 
expert, that's Greek to me." 
From Jetson's perspective, the 
developer doesn't need to know. 
The IDE will determine which 
EJB is appropriate. "It's a natur- 
al progression. Programming 
languages are getting easier. 
They are about getting people — 
as opposed to machines — to 
understand," he said. I 
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Jetson provides easy access to system components and logic constructs, without the programmer having to 
know the ins and outs of J2EE. 

SoapBox Sends an Instant Message 



BY JENNIFER DEJONG 

Helping .NET developers man- 
age workplace instant messag- 
ing more effectively, Winfessor 
Inc. delivered SoapBox Server 
2004 last month. 

Based on the XML messag- 
ing and presence protocol 
(XMPP), the server is "pres- 
ence-aware," said J.D. Conley, 
co-founder and principal soft- 
ware engineer at the Rockland, 
Calif., company. It can detect 
whether users are online, rout- 
ing messages to those who are, 
and either holding or rerouting 



via e-mail messages to those 
who aren't. 

Unlike public instant mes- 
saging services such as AOL 
Instant Messenger, Yahoo Mes- 
senger and Microsoft's MSN 
Messenger, which are widely 
used in the workplace but not 
typically integrated with enter- 
prise applications, SoapBox 
does not require users to sign 
on to the instant messaging 
application itself. Instead, it 
works with Microsoft Active 
Directory and NT LAN Manag- 
er, Novell eDirectory LDAP 



and Sun ONE Directory Serv- 
er, said Conley. 

SoapBox, which starts at 
US$495 per server, also provides 
reports on server usage and poli- 
cy features for managing permis- 
sions, said Conley. The server is 
designed to work with the Soap- 
Box Framework, Winfessor's de- 
velopment kit for building .NET 
applications based on XMPP. 
The SoapBox server competes 
with the JabberD open-source 
server, as well as commercial 
offerings from Antepo Inc. and 
Tipic Inc., both in New York. I 




NEW PRODUCTS 



StructuredSoft Inc. has created StructuredJ Open Source Foundry, 

an open-source project for developing a procedural Java scripting 
engine for developers with HTML, JavaServer Pages and entry-level 
Java skills . . . Xtras.net, an online and catalog-based reseller of .NET 
tools and components, has launched www.dotnetinfluencers.org, a 
Wiki-style collaborative site for .NET programmers to document their 
professional activities . . . N Software Inc. is bringing out IBiz Inte- 
grator, a family of components for integrating applications with 
e-commerce systems. Due out this month will be components for 
QuickBooks, credit-card and electronic check payments, and VitalPC, 
an Internet payment processor. Later, the company plans integrators 
for PayPal, eBay and Amazon.com . . . Database vendor Mark Logic 
Corp., has created XO Zone, a community Web site for XQuery devel- 
opers, at xqzone.marklogic.com . . . Techtonik Ltd. has released Activ- 
Aeon XA, a tool for helping service providers and enterprises ensure 
that they're complying with the Microsoft Service Provider License 
Agreement. This program allows companies to rent software as long as 
they submit reports to Microsoft each month. 



UPGRADES 



TotalView 6.5, a debugger from Etnus LLC, adds a proprietary real- 
time memory analyzer that the company says does not instrument 
code or alter libraries, and can provide information about leaks and 
heap allocation without waiting for static postmortem reports 
. . . Rococo Software Ltd. has updated Impronto Developer Kit, a set 
of Linux tools for working with Bluetooth ^f\*+>f\f+>f\ 
wireless networks. Version 1.3 of the kit 

supports JSR 82, the Java APIs for Bluetooth Wireless Technologies 
. . . Microsoft Corp. has released Office 2003 Service Pack 1, plus the 
second beta of SQL Server 2005. For the new beta, Microsoft is high- 
lighting its 64-bit support for the AMD Opteron processor . . . Excel- 
sior LLC has created a Linux version of Jet, its Java Virtual Machine 
that performs native-platform compilations. Previously, Jet ran only 
on Windows. Also new in Jet 3.6 is compatibility with 
code obfuscation tools and smaller-sized executable 
files for Windows. Pricing begins at US$140 . . . The Portland Group 
has updated its PGI Workstation compiler suite for 32-bit and 64-bit 
Linux. Version 5.2 supports all Fortran 95 extensions in PGF90, as well 
as the OpenMP parallel programming extensions in Fortran, C and C++. 
Portland Group claims a 10 percent performance 
improvement over version 5.1 .. . Version 4.2 of 
Tamino, an XML database from Software AG, adds 
XML-based message persistence for auditing and 
tracking, business document management, and a 
metadata repository in support of a service-oriented architecture. The 
company is now offering a developer edition of Tamino for US$2,500 
per seat; deployment costs $10,000 per processor and up . . . Accu- 
Soft Corp. has released a version of its ImageGear image processing 
toolkit for .NET. The US$1,495 toolkit works with 23 file formats, 
including TIFF, JPEG2000 and PDF. 




PEOPLE 



David Quigley, executive director of the Component Vendor Consor- 
tium since 2002, has left the organization. The CVC is trying to decide 
whether to hire another professional director or turn to volunteer 
management . . . Barry Glick has joined ObjectFX as its new president 
and CEO. A founder of MapQuest.com, Glick recently served as CEO of 
Webraska Mobile Technologies. ObjectFX's interim president, Nick 
Thomey, will step down to COO; the previous president and CEO, Tim 
Devine, left at the end of 2003 ... The SCO Group 
Inc. has promoted Sandy Gupta to VP of engineer- 
ing for UnixWare. Gupta, who had been senior direc- 
tor of Unix Engineering, replaces Wolfgang Bauer, 
who retired . . . Kent Beck, author of popular books 
on Extreme Programming and Test Driven Develop- 
ment, will be joining the technical staff of test-tools 
BECK maker Agitar Software Inc. I 
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Microsoft Updates Visual FoxPro 

Database still has a strong following among developers 



BY JENNIFER DEJONG 

SQL Server and Access get 
all the attention, but the not- 
so-famous FoxPro database 
appears to be alive and well at 
Microsoft Corp. 

Last month the company 
made available at msdn.microsoft 
.com/vfoxpro the beta version 
of Visual FoxPro 9.0. Among 
the many features new to 9.0 
is the ability to create .NET- 
compatible solutions using 
XML Web services, said Visual 
FoxPro product manager Ken 
Levy. 

The new version also offers 
enhanced SQL language capa- 
bilities and reporting features, 
as well as support for several 
new data types, including blob 
(binary large objects) and 
varbinary (which allows for 
faster indexes). 

Also noteworthy in 9.0, said 
Levy, is the ability for develop- 
ers to spice up Tablet PC appli- 
cations by taking advantage of 
the device's ability to switch the 
screen orientation between 



portrait and landscape modes. 

Although the market for 
Visual FoxPro is not expand- 
ing rapidly, the database has a 
loyal following among roughly 
100,000 users worldwide, most 
of whom have used it for more 



than 10 years, Levy said, 
adding that because it includes 
a language, an IDE shell and a 
database engine all in one, 
FoxPro is attractive to develop- 
ers who do data-centric pro- 
gramming. The language is 



tightly bound with the data- 
base engine features, and 
unlike most databases, FoxPro 
supported object orientation as 
early as 1995, said Levy. 

Originally named FoxBase, 
FoxPro was developed and 



released in the mid-1980s as an 
alternative to the then-popular 
dBase II, from Ashton-Tate. 
Microsoft acquired the product 
when it bought Fox Software in 
1992, Levy said. 

Microsoft isn't pumping 
out many marketing messages 
about Visual FoxPro, but the 
product is alive and well, said 
Levy. "The return on marketing 
just isn't there the way it is for 
Visual Studio." I 



RSA Helps Java Web Services BSafe 



BY EDWARD J. CORREIA 

Security solutions developer 
RSA Security Inc. in mid- July 
released BSafe SWS-J, the lat- 
est entry in its series of securi- 
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A series of jar files and an API work with existing 
development tools. 



ty components for Java devel- 
opers that already includes 
certificate management, cryp- 
tographic and SSL editions. 
"As developers focus more 
on Web services, we 
saw a need to secure 
those transactions," 
said Kathy Kriese 
RSAs senior product 
manager. To that 
end, BSafe SWS-J— 
the SWS signifying 
security for Web 
services — was built 
using the Java Cryp- 
tography Extensions 
architecture, Sun's 
framework and im- 



plementations for en- 
cryption, key genera- 
tion and agreement, 
and Message Authen- 
tication Codes, and 
can work with any JCE 
provider. 

The tools, which 
Kriese said are deliv- 
ered as a series of jar 
files and an API, are 
available now under can expect 
annual, perpetual or interoperability, 
royalty-based licensing says RSA's Kriese, 
models starting in the 
tens of thousands of U.S. dollars. 

"Some of the [other] Java 
security specifications aren't 
quite final yet," which Kriese 




Users of the tools 



people 



said led to RSA's sup- 
port of the OASIS 
Web Services Security 
1.0 specification, en- 
abling developers to 
expect interoperabili- 
ty with other Web 
services that also con- 
form. "In theory, it 
shouldn't matter if 
one developer is using 
[BEA's] WebLogic 
and another is using 
[IBM's] WebSphere," 
she said. "If other 
are also following the 
OASIS 1.0 specification, the 
application should be able to 
work in both environments." I 




Introducing a high-performance database that's 100% Java. 



Berkeley Dfi Java Edition 



22 



Finally there's a high-performance database that loves lava Just as much as you do: 
uVrkHpy DB JdVd EdiCiun »;,[). Bruuyh: m .u you byll-t rirf^t "\ c/lhe ubitiuiCuut. Be-*eey DIS. 
FlrrkHry Hi\ Jl~ h;ni t^-rn writtr-n r-'-lirr-y in Jnva 'mm thr n/nuncl i.p ;md i-s L.'ilnr rradr Tor 



h^^HM^HHlMBllll Tcaays dema "ding enterprise- and tens ce aravicer a pplicaticn? 



it 

Java 



■tarkulcy 3H JF hv\\ a unique 1 HrchiCL'HzLuriJ-lhart :?uilE *ux '.[li-i'd T\w ^uPCwarr l b ki'c ..V-h in 1"<; JVM ul your aonlicdlion, with M o 
■^rtirre datJ tra^l^ion or napping recused, Plus Ec--<i? cy 2B JF h^sbccn SDCCfiGflNydc-siqnrd to handle highly concurrent 
t'ansacwsns, comfortably managing gigabytes of cata. And nacause it's buil: in your lang u age c r choice, yev organlHtion 
enjoys shcrLercevelosrient cycles and accented HnMHiG-rna^tei. 

Experience the outstanding performance nf Berkeley DB JE for yourself. IltfPIK-IH* - *_ 
Itownload I3e r <eley Dl Jb iMay at ww-sltepy«.t,cofin/j|Bv.aedllifin_ Reg s:er now, anc youl l U J- IW fl fi -L 

alsu itctivt d 1 5% disccHunr. an a etirYkiiiercial license purehKed befoie November 3D r HKH. Nd I EfS flf B 2 " IE \ : J D I 









Developers love creating code,.. 
Managers crave process control. 
Bridge the gap with Seapine CM 

Software development is a team effort with developer^ totters, 
and management oil working toward one goal - delivering the 

highest quality product on Hme- 

Builton award-winning TestTrock Pro and Surround SCM, 
Seapine CM brings structure to source control and i«ue 
man age merit, improving communication while accelerating 
product development, 

Seapine CM hdp$ your team,. r 

Define custom change request workflows, putting you in control 
of w/kj makes changes and who authorizes the closure of isw* 

Associate source code changes with cfefecte or change request, 



Gain a thorough understanding of how much work remains 
before project completion. 

Vfew complete audit troth of* what changed, why, and by wham. 

Understand how close you are to reiease—how many issues ore open, 
how quickly are you closing them, how many an* re-opened? 

Succe»M team-based development requires the proper process 
supported by the right development tools. Tools that ore 
flexible, easy to use r secure, and scalable— like Seapine CM. 
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Achieve major improvements in software development performance through 
better tool integration and process automation. Manage defects H 
development issues, and Change requests with award-winning TestTrack Pro 
and gam complete control over your source code and change process with 
Surround SCWI. Saapine's integrated change management tools are feature 
rich, highly scalable, Web enabled, and cross platform. Streamline your 
development process with Seapine CM and help your team deliver qualrty 
software products on time, every time. 



Learn more about the 

Seapine CM suite at 

www.seapine.com 

or call 1-888-683-6456 
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Unity's NXJ Gets 
New Controls, Forms 




■m 



BY YVONNE L. LEE 

Unify Corp. is about to ship a 
version of its NXJ process 
automation tool that the com- 
pany claims can build applica- 
tions five to 10 times faster than 
by using an IDE. 

NXJ 10.5, which is sched- 
uled to be released Aug. 30, is 
a design environment and 
framework targeted at medium 
and large businesses for creat- 
ing and maintaining business 
Web applications on J2EE. 
Developers build business 
processes by laying out the 
business logic on a design 
template. It consists of an 
interaction server, a design and 
development center, and 
Active Web, Unify s proprietary 
system for controlling Web 
applications. 

ActiveWeb sets up a com- 
munication channel between 
the browser and Web server 
whereby information in the 
browser can be updated with- 
out having to refresh the entire 



page. It also includes controls 
that connect to underlying data 
sources. 

Development pricing for 
NSX ranges from US$3,000 to 
$11,500 per seat. Deployment 
pricing begins at $18,000 per 
processor. 

NXJ 10.5 adds several new 
ActiveWeb controls: Advanced 
Data Grid, Date Picker, Cas- 
cading Menus, and Tree, as well 
as the ability to extend the 
ActiveWeb control set with 
Custom Controls. According to 
the company, this release can 
now build J2EE-based Web 
services as well as other J2EE 
applications. Organizations can 
deploy these applications either 
on NXJ Web Server or on 
another J2EE Web server. 

These services can interact 
with .NET-based Web services, 
said Unify CTO Dave Glende. 
"You can consume .NET ser- 
vices, but you're not building 
them," he said. 

NXJ also has improved 
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Developers build Web services projects by laying out business processes in Unity's NXJ's Designer. 



forms, Glende said. An NXJ 
Form can now be mapped to a 
process definition without any 
additional programming. The 
forms also are more tightly inte- 
grated with NXJ Application 



Designer. In this release, forms 
and form components can be 
reused. These reusable compo- 
nents can be subclassed or 
extended to provide a quicker 
and more standard development 



and deployment environment. 

Other new features include 
a reporting tool that converts to 
Crystal Reports, interface 
improvements and an improved 
editor. I 
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Solutions for Language Integration 




Extend Java to .NET wrth JuggerNET, 
the only technology that is as easy and 
reliable as pure Java or punt .NET program*. 

Check out these solutions; 

1 Use any Java Message Service with .NET 
Provide .NET clients easy access to EJB 

* Integrate Java with COM through .NET 
Call J2EE servers from Vis uul Basic 

Download a free trial today: 
www.code.mesh .co m 
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Judge Puts Brakes on SCO v. DaimlerChrysler 



BY YVONNE L. LEE 

DaimlerChrysler AG didn't 
blink, and in the end, The SCO 
Group Inc. is less likely to be 
able to sue its customers who 
also are using Linux, say intel- 
lectual property attorneys who 
are following the case. 

In late July, Judge Rae Lee 
Chabot of Oakland County 
Circuit Court in Michigan 
dismissed all but one charge 
SCO had leveled against the 
automaker. 

"AT&T and Daimler had 
come to an agreement back in 
1988 with regard to Unix Sys- 
tem V," explained John Ferrell, 
attorney at Carr & Ferrell 
LLC. "One of the things the 
contract said was that AT&T, or 
now SCO, is allowed to go back 
and get a listing of each of the 
computers that is using Unix 
System V." 

However, in addition to try- 
ing to get information about 
systems running Unix, SCO 
tried to get information about 
whether Daimler had con- 
tributed to Linux and whether 
it had given away any trade 
secrets belonging to SCO, Fer- 
rell said, and this went beyond 
its contracts with SCO. 

Daimler argued that the 
contract required it to list the 
location, type and serial num- 
ber of machines running Unix, 
and nothing more. 

What's more, Daimler said it 
had not used Unix for more 
than seven years, and thus was 
not required under the contract 
to provide information about its 
computers and software. 

Chabot examined the con- 
tract and determined that 
Daimler was correct, Ferrell 
said. Because she made the 
decision based on contract law, 
Chabot did not have to make 
legal determinations such as 
whether computer end users 
can be liable for copyright 
infringement, Ferrell said. 

"What they tried to do is 
they tried to leverage a fairly 
straightforward audit in order 
to look into all sorts of other 
things," said Mark Radcliffe, 
intellectual property attorney 
at Gray Cary Ware & Freiden- 
rich LLP. "The court said that 
isn't what the audit provision 
was for." 

Nevertheless, the Daimler 
ruling is likely to prevent SCO 
from using software licenses to 
try to gain information about 



organizations' computer sys- 
tems for purposes such as 
attempting to charge Linux 
users for a Unix license for 
every copy of Linux they are 
running, said Radcliffe. 



UNIX SYSTEM LABS REDUX 

Separately, SCO, which had 
been called Caldera Inc. until 
after its lawsuit against IBM 
Corp., in June applied to regis- 
ter the trademark Unix System 



Laboratories with the U.S. 
Patent and Trademark Office. 

However, this move may 
not be successful because The 
Open Group owns the Unix 
trademark. Unix System Labo- 



ratories was a division of 
AT&T that developed Unix. 
AT&T sold its Unix business 
to Novell in 1993. Novell sold 
the Unix trademark to The 
Open Group. I 
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UML Adoption Making Strong Progress 



BY ALAN ZEICHICK 

UML is popular. But the use of 
the Unified Modeling Language 
varies tremendously from orga- 
nization to organization. 

A study conducted in July by 
BZ Research shows that more 
than two-thirds of development 
managers say that UML is used 
to some extent within their 
organization. About 20 percent 
say that UML is used for all 
projects; 58 percent say that it 
is used for some projects. About 
18 percent replied that UML is 
never used, while 3 percent 
responded that it was used in 
the past but is no longer used. 

The study, which has an 
accuracy of within 3 percent, 
was completed by 347 individu- 
als. BZ Research is a subsidiary 
of BZ Media LLC, publisher of 
SD Times. 

Of those who said that UML 
was used for some or all of a pro- 
ject, nearly half — 49 percent — 
said that UML is used only dur- 
ing project development, while 
15 percent said that it is always 
used for the full life cycle of a 
project. Twenty- five percent 
said that it's sometimes used for 
development only, sometimes 
for an entire project. 

When asked about future 
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Source: BZ Research 

intentions regarding the use of 
UML, the results were nearly 
evenly split, with 42 percent say- 
ing that they intend to model all 
future projects in UML, and 40 
percent saying that they plan to 
model some, but not all, projects 
that way. Thirteen percent didn't 
plan to use UML in the future; 5 
percent weren't sure. 

Why use UML? The most 
common reason, selected from a 
group of 10 predefined choices, 
is because UML improves com- 
munication within a project 
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team, with 69 percent of respon- 
dents choosing that option. 
Other popular reasons were 
because UML allows software 
to better meet requirements 
(51 percent), because applica- 
tions written with UML are eas- 
ier to maintain (40 percent), 
because UML allows software to 
be built more quickly (39 per- 
cent), and because software 
written with UML has fewer 
defects (25 percent). 

Why don't developers use 
UML, or use it more? The most 



popular reasons were because 
the project team doesn't under- 
stand UML-based modeling (33 
percent), because modeling 
slows down the development 
process (24 percent), because 
UML tools are too expensive (21 
percent), because the project 
team simply doesn't need UML 
(20 percent), and because UML- 
based modeling adds to overall 
project costs (19 percent). 

Of those who use UML, 
there was strong interest in the 
new UML 2.0 specification. 
Eleven percent indicated that 
they've already moved to UML 
2.0, while 17 percent said that a 
move is currently in progress. 
Another 26 percent said that 
they plan to move to UML 2.0 
but haven't started yet. Six per- 
cent said that they use UML 1.0 
but don't plan to move to the 
new version, while the biggest 
group — 39 percent — weren't 
sure what they would do. 

When the study asked about 
Object Management Group's 
Model Driven Architecture ini- 
tiative, results showed little 
adoption. Only 4 percent said 
that they've moved to MDA- 
based development, and 3 per- 
cent said that such a move is in 
progress. Another 9 percent plan 



to move to MDA-based develop- 
ment some day. On the other 
side, 11 percent said that they're 
following the progress of MDA 
but aren't planning to adopt it, 
45 percent aren't even paying 
attention to it, and 28 percent 
simply indicated "don't know." 

UML has made significant 
progress over the past two 
years. In a similar UML study 
conducted in June 2002, 1 per- 
cent of respondents said that 
they model all applications in 
UML, while 32 percent said 
they model some applications 
using the language. At that 
time, 26 percent of respondents 
said that they would begin 
using UML within the next two 
years. That estimate seems to 
have been fairly accurate. I 

Ha-v challenqlnq Is UML 
to learn and apply? 
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L: Too Big, Too Small Just Right? 



* continued from page 1 

them by simplifying things, he 
said. Selic claimed that UML 
2.0 does address the size issue. 
"We were very aware of this 
problem in assembling UML 
2.0. We took it apart and put it 
back together so it is modular." 
The specification includes sub- 
languages, including event- 
driven modeling and activity 
modeling, which are mutually 
independent, allowing UML 
users to work with a single 
sublanguage if they choose to, 
he said. 

But according to Kobryn, 
using UML 2.0 tools for real- 
world development projects 
often results in confusion. "If you 
look over the diagram types, you 
will get deja vu attacks." For 
instance, the Component dia- 
gram and Composite Structure 
diagram are 90 percent similar, 
he said. "From a design stand- 
point, why include two diagrams 
that do the same thing? You 
should whack one of them." 



Also, the sublanguages for 
Activity and Sequence are large- 
ly equivalent. Further complicat- 
ing matters is a hybrid of the two, 
called Interaction Overview, he 
said. "The language is just too 
large, and a lot of people find 
that out by trial and error." 

PEOPLE WILL TALK 

Whether that's true is still to be 
determined, said Jan Popkin, 
founder and CEO of Popkin 
Software, in New York, and a 
member of OMG's Finalization 
Task Force for UML 2.0. If 
Kobryns comment — UML 2.0 
is too fat — holds water, users 
will let vendors know, he said. 
"There are a lot of diagrams in 
UML 2.0. You could make the 
argument there could have 
been fewer." 

But who is wrong and who is 
right is not the issue. "What they 
are really asking is: What is the 
future of UML?" said Popkin. 
That people are critiquing UML 
is a good thing, which will help 



advance the standard, added 
Popkin, who pointed out that 
Kobryn has a vested interest in 
bashing UML 2.0s bulk. "He 
was wearing a certain hat when 
he made that comment," said 
Popkin, and indeed, Kobryns 
PivotPoint helps clients create 
modeling strategies around a 
subset of UML 2.0 diagrams. 

Kobryn did not confirm 
whether his company plans to 
sell a product based on that 
subset, but he said: "PivotPoint 
is extremely interested in the 
rapid evolution of the modeling 
language." 

Microsoft also is getting in 
on the conversation. The com- 
pany announced plans in May 
to include modeling tools in 
Visual Studio 2005 Team Sys- 
tem. It previously characterized 
its modeling strategy as "UML 
and more," noting that tools 
based solely on UML do not 
map precisely enough to the 
.NET Framework's Common 
Runtime Language. 



Also at issue is that UML 
tools don't integrate closely 
enough with the life-cycle 
development process, said 
Microsoft's Jack Greenfield, an 
architect for Visual Studio Team 
System, who formerly worked 
for Rational Software Corp. pri- 
or to its purchase by IBM. 
Although many UML offerings 
generate code, and some sup- 
port "round-trip engineering" 
(the ability to keep the code and 
underlying model synchro- 
nized), today modeling tools are 
used primarily for documenta- 
tion, Greenfield said. 

"UML diagrams are not 
closely enough associated with 
the way the software is built." 
The visual surface on which the 
architect works should function 
as a real tool, he added. "It 
should produce the things I 
have to deliver: the code, the 
configuration files and so 
forth." 

At least two respondents to a 
survey conducted by BZ Re- 



search last month echoed that 
view. "Drawing boxes doesn't 
finish projects," said one. 
"Straight UML simply doesn't 
translate into the best possible 
code for the solution," said 
another. 

The survey asked readers of 
SD Times whether UML is used 
within their development orga- 
nizations and if so, how it is used. 
Fifty-eight percent said they use 
UML for some projects. But of 
those, only 15 percent said they 
use UML for the full life cycle 
of the project. (See related story 
above.) BZ Research is a 
subsidiary of BZ Media LLC, 
publisher of SD Times. 

While Microsoft's modeling 
plans deviate from UML, Pop- 
kin does not see the company's 
approach as a departure from 
the industry standard. Micro- 
soft is one of several players 
helping to fine-tune the stan- 
dard. "Microsoft is tuning 
UML, which makes it more 
valuable," he said. "They are 
helping to move UML forward. 
If they had trashed UML, that 
would have been a whole other 
story." I 
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BEA Ships Application Server for SOA 



BY YVONNE L. LEE 

BEA Systems Inc. began ship- 
ping in late July a higher-end 
version of its WebLogic server 
aimed at deploying service- 
oriented architectures. 



The US$27,000 per-processor 
WebLogic Server Process Edi- 
tion adds business process man- 
agement, data transformation 
and process monitoring to the 
standard WebLogic Server 8.1. 



The data transformation fea- 
tures make it possible to map 
data from different sources. It 
translates how different appli- 
cations describe data. 

In addition to shipping the 



WebLogic Server Process Edi- 
tion, the San Jose company 
announced that it would release 
its particular Xquery imple- 
mentation to an unspecified 
open-source group. Xquery is a 
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W3C specification for querying 
XML data. 

"Its designed to be a standard 
language to manipulate, trans- 
form and extract reports from 
collections of XML documents," 
said Liam Quin, XML activity 
lead at the W3C. It's often 
thought of as SQL for XML, but 
it can query documents other 
than XML documents and rela- 
tional databases, Quin said. 

"If it isn't in XML, your 
query processor has to make it 
look as if it was with angle 
brackets," he said. 

BE As Xquery processor is 
one of more than two dozen 
implementations of the in- 
process specification. Dave 
Cotter, director of developer 
marketing, said BEA uses 
Xquery to map between unlike 
data sources. "We haven't made 
a decision as to where it will 
be," he said. I 

VSLive Focus: 
Microsoft Plans 

BY ALAN ZEICHICK 

Next month, the VSLive con- 
ference in Orlando, Fla., will 
focus on Microsoft Corp.'s 
future plans. Three keynote 
presentations, all delivered by 
Microsoft executives, will dis- 
cuss the company's plans for the 
future of the Microsoft devel- 
oper platform, connected sys- 
tems and Web services, and ser- 
vice-oriented architectures. 

The event, produced by 
Fawcette Technical Publica- 
tions, has sessions on .NET, 
Visual Basic, ASP.NET and C# 
development in three separate 
tracks. There also are seven 
full-day preconference work- 
shops and tutorials. 

Monday is a special .NET 
Focus Day, presented by 
Microsoft. I 
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CONFERENCE: Sept. 11-15 

JW Marriott Grande Lakes Resort 
Orlando, Fla. 

PRECONFERENCE WORKSHOPS: 
Saturday, 9 a.m-6 p.m. 
Sunday, 9 a.m-6 p.m. 

CONFERENCE SESSIONS: 
Monday, 9 a.m-6 p.m. 
Tuesday, 9 a.m-6 p.m. 
Wednesday, 9 a.m-6 p.m. 

www.vslive.com/2004/or 
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OMB: Free Software Isn't Cheap 

Office of Management and Budget outlines open-source risks 



BY JENNIFER DEJONG 

Free software may be too costly 
for taxpayers. 

That sums up a key position 
held by the U.S. governments 
Office of Management and 
Budget in a memo it sent last 
month to senior procurement 
executives who acquire soft- 
ware for the government agen- 
cies they work for. 

The memo reminds decision- 
makers to "consider the total 
cost of ownership" for all soft- 
ware acquisitions. Although the 
memo says the reminder applies 
to both open-source and propri- 
etary software, it targets what it 
sees as risks associated with 
open-source software. Open- 
source licensing "may affect the 
use, the security, and the total 
cost of ownership of the software 
and must be considered when an 
agency is planning a software 
acquisition," the memo says. 

An OMB spokesperson did 
not respond to requests for addi- 
tional information, including 
specifics about what (or who) 
precipitated the memo and 
whether government agencies 
had run into actual problems 
using open-source software. 

But Tom Schatz, president 
of Citizens Against Govern- 
ment Waste, a nonprofit watch- 
dog group in Washington, D.C., 
believes that by issuing the 
memo, the OMB, whose mis- 
sion is to assist the president in 
preparing the federal budget, is 
taking a stand against open- 
source software. 

"Earlier there was some 
consideration given to making 
open source a higher priority. 
We certainly welcome the clari- 
fication," he said. "People mis- 
takenly refer to open source as 
'free' software. Yet while the 
software itself is free, the cost 
to maintain and upgrade it can 
become very expensive." 

TOO SELECTIVE? 

Bill Weinberg, an open-source 
architecture specialist at the 
Open Source Development 
Labs, an organization that pro- 
motes the adoption of Linux, 
said: "In principle, we agree with 
the notion of considering total 
cost of ownership. But total cost 
of ownership studies are to some 
degree biased and use selective 
analysis techniques." 

Weinberg argued the OMB s 



memo is misleading because it 
does not clearly characterize 
the licensing issues associated 
with open-source software. 



For instance, he said, the 
memo states: "Frequently, the 
licenses require users who dis- 
tribute Open Source Software, 



whether in its original form or 
as modified, to make the source 
code widely available." That 
appears to imply that users 



must redistribute open-source 
software they extend. 

"But they themselves are 
unlikely to redistribute software 
to anybody," he said. It's not 
that the OSDL is a proponent 
of open source at any cost, he 
added. But there are support 
costs associated with commer- 
cial software, too. I 
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Keynote Speaker: CEM KANER 

"The Ongoing Revolution in Software Testing 11 

Cern Kgrer ^ a professor gf splfware engineering ^1 1he Flnr da Institute gf Tethnglg^y and director 0-f 
Florida Tech" 5 Center f^r Software Telling Education & Research, Bgnari ir Silicon Valley hetcre [pining 
Florida Tech, Karer wrjntRd as a programmer, hjmnn factors analyst, software development manager, 
tester, test manager, writer, technical publications manager, indop&rd^nt consul tarl and attorney 
focused on the law of software quality. Kaner decided: to shift to universi:y teaching in 1999 in order to 
develop a curriculum to r software : earing. His belie* then was [and stil is) that the set o J knowledge and 
skills needed to no competent testing has been evolv ng mpid y, and needs J5t r onrj educational support 

He hss been senior authof of three books on sol^waretest ng and qjality: Lessons Leaned an Software 
Testing (with James Bach and BrtV Rett irhord}, Tasting Computer Software (2nd edition, with Jsck Falk 
and Hung? Q. Nguyen), and Grid Software: What to Do When Software Fails (wth Davin Pels) 
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ROBERT C. MARTIN 

Rgtvart C- Menln h^S baw a software ppp^assbnal ahoe l9tf>. 
He s CEO and fopndfi* of Ohjft^t Mentor Inc.. a training, 
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Mobility: Potholes, Red Lights and One-Way Streets 



< continued from page 1 

Fifth Avenue. But Fleischman 
said that for mobilizing the solu- 
tion, which was built using 
IBM's WebSphere, major chal- 
lenges involved "creating a 
seamless experience with what 
was designed as a Web applica- 
tion that assumed constant con- 
nectivity." Many mobile devices 
are often disconnected. 

Blue Martini started with 
the Workplace Client platform, 
a new middleware- and client 
software-based model from 
IBM Corp. that replicates desk- 
top functionality on devices 
running Linux, Pocket PC, 
Symbian and Unix. "Workplace 
Client provided the ability to 
deploy a Web-based application 
on a [mobile] client without 
changing the architecture, and 
allowing it to run when discon- 
nected," said Fleischman. 

Jim Colson, IBM's chief 
architect for client software, 
explained that while the plumb- 
ing is all there to allow Web- 
based apps to run unchanged, 
such apps are often built 
assuming full-time connections 
to services such as credit-card 
validation, and to inventory 
data and shipping schedules. 
"When you're in the field with a 
disconnected application, you 
have to submit a pending order 
with an estimate of price and 
shipping, pending confirmation 
on reconnection." 

Colson said application 
changes, though necessary, are 
generally slight. "You have to 
introduce the intermediate 
state of an order pending com- 
pletion," which he said for a ful- 
ly connected Web app can be 
buried inside of a session bean 
while still appearing like an 
atomic operation. 

"But when disconnected, you 
can reuse that code to support 
the disconnected capability." 
Minor changes to back-end sys- 
tems include the addition of 
management, deployment and 
synchronization tools, he added. 

TO SYNC OR NOT TO SYNC 

Colson said among the first steps 
toward mobilization is selecting 
how the application will commu- 
nicate with the back end — either 
by synchronization or messag- 
ing — a decision that depends on 
what's taking place in the field. 

If the sequence of events is 
important, such as in transac- 
tional systems, then messaging 
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Source: Extended Systems Inc. 



Extended Systems combines client- and server-side middleware to mobilize enterprise applications. 



would be most appropriate, 
Colson said. "Once an order is 
received, the sequence is 
important for fulfilling that 
order to keep inventory accu- 
rate and adhere to the cus- 
tomer's credit limit." 

Synchronization is most often 
used for catalogs and other refer- 
ence applications indifferent to 
the sequence of updates. "In the 
case of a catalog, you would use 
synchronization to bring over the 
deltas that occur when price or 
inventory changes," Colson said. 

HOW MUCH DATA WHERE? 

The next step, according to 
Senthil Krishnapillai, senior 
product manager for the mobile 
platform group at Extended 
Systems Inc., is to decide how 
much data needs to be cap- 
tured and sent to or from the 
device. Extended develops and 
markets solutions for mobiliz- 
ing enterprise applications. 

Krishnapillai said he gener- 
ally divides mobile apps and 
their users into three basic cat- 
egories: reference-oriented, for 
occasionally connected service 
and inventory workers for 
whom a data snapshot is ade- 
quate for a day or more; trans- 
actional, for time-sensitive 
applications that require con- 
stant connection and up-to-the- 
minute data; and the offline 
application running on a device 
that still has a full-time connec- 
tion, such as a smart phone. 

For the latter, Krishnapillai 
said Extended technology uses 
Short Message Service (SMS) to 
push data from the server to the 
device and vice versa — without 
incurring the cost of a wireless 
call. "As soon as info is updated, 
we send that information back to 



the server, so there's no discrep- 
ancy between what is sold and 
what's available on the server." 
SMS is good for regional applica- 
tions over known carriers, he 
said, but it's often too expensive 
for global applications. "It can 
cost 35 cents for one message 
across the Atlantic, for example." 

Extended offers a server- 
side middleware framework, an 
SDK and libraries for Visual 
Studio, Code Warrior and other 
environments that include pre- 
developed connectors for major 
databases, SAP and the Java 
Connection Architecture. "All 
the developer has to do is 
define the tables he will be 
using in which database," 
Krishnapillai explained. 

A wizard displays the data- 



base fields, and the developer 
selects which ones to expose on 
the device. "We then automati- 
cally push that configuration to 
the device, and the developer 
can build the application 
around that." The same method 
applies to other packaged appli- 
cations, he said. 

MAKING CONNECTIONS 

The automation process was no 
such walk in the park for Stew- 
art's Shops Inc., a chain of con- 
venience stores based in Sara- 
toga Springs, N.Y., that set out 
to replace the paper-based 
ordering system used in its 319 
stores with an automated one. 

"We wrote all the client- side 
software in C + + and Visual 
Basic," said Rick Cobello, 



director of information solu- 
tions at Stewart's, describing a 
form-based application it devel- 
oped for Compaq iPaq hand- 
held computers running Pocket 
PC that store managers now 
use to place orders. 

"They use drop-down 
menus for item selection," he 
said, rather than a system that 
involved scan cards. "Because 
of the way the paper-based sys- 
tem worked, our drivers picked 
up the sheets for the store's next 
order as they dropped off the 
current order. So they were 
guessing" at their inventory 
needs. He said the new system 
reduced order turnaround to 24 
hours from three days. 

According to Cobello, Stew- 
art's developers also were chal- 
lenged by a lack of communica- 
tions; none of the stores had 
broadband connections, so a 
dial-up solution had to be devel- 
oped. "Each of the iPaqs has to 
dial with its own internal 
modem; I think we're using the 
last of the iPaqs that can do that." 

Along with improvements to 
ordering efficiency came reduc- 
tions in training time. "The 
ordering process was very convo- 
luted, so training was difficult," 
Cobello said. "The ordering 
process is now available to all 
staff, and training time has gone 
from days to minutes." He 
claimed the new application has 
saved the company about 
100,000 hours of labor per year. I 



Intellisync on Verizon Wireless Network 

Nation's largest carrier lets developers cut the PC cord 



BY EDWARD J. CORREIA 

A cell-phone app that relies on a 
desktop or laptop for synchro- 
nization stretches the definition 
of mobile. A recent deal between 
Verizon Wireless and Intellisync 
Corp. is said to enable users of 
palmOne's Treo 600 Palm OS- 
based smart phone to synchro- 
nize using Verizon's network, 
enabling enterprise developers 
to cut the cord from apps that 
formerly docked with a PC to 
send and receive changes. 

According to Rip Gerber, 
Intellisync's chief marketing offi- 
cer, that means the enterprise 
now has a broader selection of 
devices for application deploy- 
ment. "I don't have to force 
users into one particular device 
for control and security," said 



Gerber, comparing the Treo 
with major competitor Black- 
berry, which requires its own 
server to provision the devices. 
"The Treo 600 is Palm's Black- 
berry killer. Now the enterprise 
can [deploy] one server and one 
system management piece to 
control all devices." 

Enterprise developers will 
have the ability to sync with 
individual clients or groups, and 
to push data to devices without 
initiation by the client. "It's also 
about data and file synchroniza- 
tion, attachments and enhanced 
PIM with data sync," said Ger- 
ber. Pricing for the suite, which 
also includes device manage- 
ment, is based on the number 
of enterprise data sources, 
back-end platforms and devices 



to connect, and can run into 
tens or hundreds of thousands, 
Gerber said. 

The tools, which are known 
by Intellisync customers as 
Mobile Suite, will be marketed 
by Verizon as Wireless Sync, and 
will work with BE As WebLogic, 
Microsoft's Exchange, and 
IBM's Domino and WebSphere 
servers, as well as I MAP and 
POP-based e-mail servers and 
Samsung's i600 and i700, 
Kyocera's 7135 and RIM's 
Blackberry devices. 

According to Gerber, Intel- 
lisync tools have been behind 
the Palm synchronization 
engine since the first Palm 
Pilots, and also are used in 
IBM's WebSphere mobile 
development tools. I 
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The Microsoft Road 



Redmond seeks to bring order to back-office 
chaos by reinventing its 19 servers 



BY LARRY O'BRIEN 



Software development managers 
are often asked to make the cru- 
cial recommendation that decides 
between what the development 
teams eager to exploit the func- 
tionality of a new type of server want, 
and what the conservative IT teams that 
focus on the real burden of keeping the 
servers working 24x7 worry about. 

That's been a real challenge for Mi- 
crosoft shops, who find the difficulties 
associated with installing, integrating and 
customizing a new Redmond server, 
such as Exchange Server or SharePoint 
Portal Server, to be a huge effort — as 
much work, or perhaps more work, than 
bringing in a third-party server. 

If Microsoft Corp. is going to live up 
to its promise of being a one-stop shop 
for enterprise developers and IT staff, 
its servers need to work together and 
play together better, especially when it 
comes to building in-house applications 
that take advantage of their capabilities. 
At its Tech-Ed conference earlier this 
year, Microsoft laid out the solution, or at 
least hinted at it. The Common Engi- 
neering Roadmap is a vague series of 
promises on the behavior, deployment 
and documentation that are hoped to 
create a baseline of comfort in customers 
when pondering a commitment to new 
server technologies from Redmond. 

There is a considerable due diligence 
burden on the team considering the use 
of a new server beyond the question of 
the worth of the core functionality — one 
has to consider the server product's 
upgrade path, its hardware and software 
requirements, its administrative inter- 



face and flexibility and, not least, its 
learning curve. The Common Engineer- 
ing Roadmap is a promise to reduce that 
burden, in part by providing consistent 
capabilities among Microsoft's 19 
servers (see list below) and in part by 
documenting where a particular server 
lapses from the road map. 

GOING WIDE, NOT DEEP 

The Common Engineering Roadmap, 
primarily laid out in a white paper at 
www.microsoft.com/windowsserver 
system/overview/engineeringroadmap 
.mspx, reads in large part like an internal 
directions memo. 

It contains no concrete advice for 
customers beyond the obligatory boost- 
erism of Microsoft server products as 
all-around wonderful things. The obliga- 
tions imposed by the memo are univer- 
sally inward-facing: Microsoft's teams 
will provide such-and-such at the time of 
launch, this-and-that within 90 days and 
so forth. It should be pointed out early, 
though, that the road map allows for 
"exemptions" from its strictures, at least 
initially. 

The road map spreads out across a 
number of areas: security, deployment, 
management, availability and respon- 
siveness to customer needs in the 
upgrade cycle. The security comments 
are particularly interesting because they 
give insight into Microsoft's integration 
of security into the software develop- 
ment process. 

Public resources on Microsoft's 
Secure Windows Initiative, the SD 3 +C 
Framework, and the resulting Security 



NOW SERVING: 19 VARIETIES 


BizTalk Server 


Project Server 


Commerce Server 


SharePoint Portal Server 


Content Management Server 


Small Business Server 


Exchange Server 


Speech Server 


Host Integration Server 


SQL Server 


Identity Integration Server 


System Center Reporting Server 


Internet Security and Acceleration 


System Management Server (SMS) 


Server (ISA) 


Virtual Server 


Live Communication Server 


Windows Server 


Operations Manager Server (MOM) 


Windows Storage Server 



Development Life Cycle are scarce, even 
though security is a topic that should be 
addressed in all software projects. 

Essentially, SD 3 +C is a "framework" 
not in the programming sense 
but in the conceptual 
sense: Security should be a 
concern of design, it should 
be the default behavior, and 
it should be encouraged in 
deployment and enhanced by 
communication. Indeed, the 
acronym itself means Secure by 
Design, Secure by Default, 
Secure in Deployment and Com 
munications. 

More concretely, with the road 
map, Microsoft is adding specific 
tasks and checks throughout the life 
cycle, as suggested in the diagram on 
page 21. 

SECURITY TESTING INCLUDED 

In addition to the life-cycle model, each 
server will support being scanned by the 
Microsoft Baseline Security Analyzer, 
which reviews the configuration, compo- 
nents and updates and uses heuristics to 
diagnose known vulnerabilities. 

Of course, nothing that Microsoft can 
do will eradicate vulnerabilities either 
at the implementation level or from end- 
user misconfigurations. The Slammer/ 
Sapphire worm demonstrated the speed 
with which a relatively small number of 
vulnerable hosts could be found, corrupt- 
ed and used to devastating effect. 

Slammer proved that even a locked- 
down firewall is useless if laptops can 
bring malicious code into the protected 
network. Microsoft shops will probably 
always have to exercise more diligence 
in protecting their systems from 
exploitation than shops choosing alter- 
nate technologies; tools such as the 
Baseline Security Analyzer can, at best, 
make that diligence more tolerable. 
Developers can download the analyzer 
at www.microsoft.com/technet/security 
/tools/mbsahome.mspx. 

A common source of "misconfigured" 
systems arises when companies require 
multiple server technologies to intemp- 





erate. Too often, this has necessitated 
tweaking configurations in ways that 
introduce vulnerabilities. To some 
extent, this is mitigated by the rise of 
Unicode-based XML for integration — 
it's much easier to configure, monitor 
and modify a channel between systems 
when the channel carries only text-based 
documents and transports them with a 
standard protocol. 

Still, if for no other reason than per- 
formance, many systems involve lower- 
level integration between different 
servers. As part of the road map, 
Microsoft promises to test "core scenar- 
ios" involving multiple Microsoft servers 
to ensure that the systems work well 
together. It's hard to know what to make 
of this promise: There are theoretically 
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19 factorial, or 121,645,100,408,832,000, 
possible configurations of the servers, 
assuming only one instance of each, and 
not counting the many different ways of 
configuring those servers and their hard- 
ware platform. 

So how will the combinatorial explo- 
sion be winnowed? Which team will 
have to make adjustments to an incom- 
patible product? Will a particularly trou- 
ble-prone server tend to be included or 
excluded from testing? Without full 
disclosure of which configurations have 
been tested, and where problems occur, 
developers may still find themselves 
pioneering some scenarios. Of course, in 
reality there are fewer than 121 
quadrillion choices, but still the situation 
can be daunting. 

DEPLOYMENT 

For deployment, the road map states 
that all the servers must support run- 
ning under Virtual Server and must be 



runnable in 64-bit Windows. However, 
at least initially, servers will be allowed 
to run in the Windows-on-Windows 
32-bit emulation mode of Win64. 
Compatibility with native 64-bit mode 
is part of the vision for the road map, 
but not a requirement. 

Given that even commodity servers 
are already bumping their heads against 



RAM limits of 32-bit addressability, the 
transition to native 64-bit modes is crit- 
ical. Obviously, SQL Server will lead 
the charge to 64-bit mode because 
databases can often take great advan- 
tage of 64-bit computing, but proces- 
sor-intense technologies such as 
Speech Server also have a strong incen- 
tive to move to the more efficient 
instruction sets of the 64-bit chips. 

Leaner servers may be consolidated 
on one piece of hardware within 
Virtual Server sessions, pro- 
viding some protection against 
crashes. Of course, this discus- 
sion ties back to the previous 
comments on the difficulty of 
integration testing. 

All servers will support Win- 
dows Installer and Windows Up- 
date. Microsoft promises that 
this will result in finer-grained 
control of the exact software level 
installed, with support for roll- 
backs and smaller patches. 

In addition, all servers must pro- 
vide, at launch, a Microsoft Opera- 
tions Manager management pack and 
must service that pack on the same 
schedule as the core product. This will 
create a consistent, fully remotable 
administrative interface across the server 
products. Also, these management packs 
have a product knowledgebase built into 
their remote monitoring stack, so to some 
extent failures can be diagnosed quickly 
(and, since the packs will be updated in 
lock-step with produce releases, should 
not result in false diagnoses). 

ACKNOWLEDGING COMPLEXITY 

A refreshing aspect of the road map is 
that it acknowledges that server tech- 
nologies will always have a major degree 
of complexity to them and lays down 
quite specific rules for training and edu- 
cational resources. All servers will have 
"core" planning documents at launch. 
These will include deployment and 
operational training resources as well as 
a training road map. 

"Non-core" training (sadly, develop- 
er training is included in this category), 



will be available within 90 days of 
launch. Redmond also will provide on 
TechNet prescriptive guidance for 
common scenarios. 

Within the road map, a number of 
required prescriptive guides are speci- 
fied: "Getting Started," "Planning and 
Architecture," "Security," "Deployment 
and Test," "Operations," "Migration and 
Upgrade" and "Interoperability and 
Coexistence." While prescriptive guid- 
ance from Microsoft has been available, it 
has been spread across a number of areas 
("Systems Architecture," "Solution Accel- 
erators" and "Patterns and Practices"). In 
the future, these different sources will be 
integrated under a new "Windows Server 
System Infrastructure Environment." 

Another major administrative com- 
mitment is that all servers must support 
a command line for scripting and/or be 
Windows Management Instrumenta- 
tion-enabled. WMI is already supported 
for some administrative tasks in Win- 
dows and is quite potent. One would 
expect the next generation of the Win- 
dows shell (code-named Monad) to 
unleash this power. 

Monad, an acknowledgement by 
Microsoft that the pipes-and-filters 
model of Unix administration and 
scripting is both appealing and power- 
ful, looks extremely promising. 
Although nominally tied to the Long- 
horn release, it appears that Monad will 
also run on legacy operating systems — 
that is, older versions of Windows — that 
can run the necessary .NET Common 
Language Runtime. 

A server product is useless if it is not 
highly available, and the road map lays 
out some promises on that subject as 
well. Stateless servers (such as Speech 
Server) are required to support network 
load balancing. Things are more strin- 
gent for stateful servers. The Enterprise 
Edition of each server product will sup- 
port high- availability technologies. In 
addition to load balancing, they must 
support failover clustering by way of 
Microsoft Cluster Server, online backup 
and restore, and must survive failures 
► continued on page 22 
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^ continued from page 21 

without corrupting stored state 
or losing transactions. 

BEING RESPONSIVE 

The final theme of the road map 
is what Microsoft calls "respon- 



siveness. '' Like training, this is an 
area that seems more specific 
and fleshed out than some other 
areas. First, there's Microsoft's 
laudable commitment to a 10- 
year product-support life cycle. 
While this won't necessarily 



extend to service packs for very 
old products, the road map does 
lay out that service packs will be 
produced for both "N" and "N- 
1" versions. The obvious point of 
this is to prevent (at least for a 
while) security-forced upgrades. 



Also, in response to the sensi- 
tiveness that IT teams have 
to unnecessary or unexpected 
change, each server technology 
must have a product upgrade 
road map with a time line for 
issues that might cause compati- 
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bility breaks. Further, each serv- 
er will "try" to provide a two-year 
warning for feature deprecation. 
The road map lays out some 
specific imperatives on defect- 
correction and product releases. 
At a minimum, the top 10 issues 
driving product support calls 
must be addressed in a release as 
well as the issues causing the top 
10 Watson dumps. Watson 2.0, a 
variant of the "Dr. Watson" 
client-side utility, is required by 
the Windows Server System. 
Error dialogs generated by Wat- 
son either can be queued for 
viewing or, for unattended 
servers, can be turned off entire- 
ly, with the dumps automatically 
forwarded to either a local 
reporting server or directly to 
Microsoft. In addition, each serv- 
er will have an Internet-based 
feedback center for customers to 
communicate more directly with 
the relevant product team. 

THE ROAD AHEAD 

The road map lays out a more 
ambitious vision for its own 
evolution. This vision includes 
for all servers: native 64-bit 
support, role-based security, a 
best-practice analyzer akin to 
the security analyzer, CLR 
"support" (although whether 
this means hosting such as sup- 
ported in the Yukon version of 
SQL Server is unclear), no 
reboots when upgrading or 
patching, a software "big red 
switch" for bringing the server 
offline rapidly, self-monitoring 
and configuring for perfor- 
mance, security commitments 
based on the analyzer results, 
IPv6 support, support for 
Longhorn's "Crimson" remote 
logging and diagnostics, and 
enough specificity in error-log- 
ging so that Microsoft support 
can isolate the defect from a 
single incident. 

But there are no real pro- 
mises, and no time line. 

The server technologies 
falling under the umbrella of 
the road map are now being 
evaluated against the program's 
imperatives; their final evalua- 
tions will be published on the 
main Windows Server System 
site of www.microsoft.com 
/windowsserversystem with 
links back to the common crite- 
ria. The degree to which exemp- 
tions are invoked in these docu- 
ments will essentially proclaim 
the long-term relevance of the 
road map: If this type of align- 
ment can't be achieved during 
the companywide run-up to 
Longhorn, it's highly doubtful it 
will ever be achieved. I 
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Software FX Breaks the Language Barrier 

The Chart FX for Java Architect explains the intricacies of maintaining a single code base for aH Chart FX products 
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EDITORIAL 

On the Road: Again and Again 

The concept of application mobility may be a solu- 
tion — or a series of solutions — looking for a problem. 

Consulting companies, platform vendors, tools 
providers, carriers — nearly everyone in the software devel- 
opment ecosystem has jumped onto the mobility bandwag- 
on. Make applications run on a smart phone. Enable seam- 
less WiFi-based rich-client computing. Bring the 
client/server model to Windows CE devices. Add light- 
weight databases, message-queuing middleware, runtime 
containers. Make it mobile. 

It's an impressive vision, and at conferences like 
JavaOne and Tech-Ed, there are many equally impressive 
demonstrations. There are only two problems with mobil- 
ity, as presented today by the vendor community. First, 
real-world applications aren't as easy to build, deploy and 
manage as their slick demonstrations would lead you to 
think. Second, while some enterprises may have a com- 
pelling need to write new mobilized applications or 
extend existing ones, the majority of enterprise apps need 
never go beyond the firewall — or the desktop. 

For the past decade, more or less, enterprise develop- 
ers, and ISVs writing business applications, could count 
on at least some homogeneity among client platforms. 
For the most part, for example, they were running a full- 
featured operating system, typically a flavor of Windows 
or the Macintosh, and thus offered a fairly consistent API. 
More recently, cross-platform apps could be written to 
run within a browser, or in a J2SE virtual machine. 

Further, the developer or post-deployment administra- 
tor didn't have to worry about the connection between 
the client and the server. It was consistent and persistent, 
and could be safely ignored. 

There were also no transaction costs, no intermediaries, 
between the client and a server. Even if there were a remote- 
access link, such as over a dial-up modem, Frame Relay 
connection or an Internet VPN, it, again, could be ignored. 

Within the world of mobility, that's not true. There are 
many form factors of clients, each with its own operating 
system, hardware constraints and runtime environment. 
Connection quality can vary tremendously. There are 
many service providers in the loop, some of which want to 
collect tolls for message traffic, or for making available a 
downloaded application. 

Developers, administrators and line-of-business cus- 
tomers who want mobilized applications have to prepare 
not only for the added complexity of writing applications 
that will support such a diverse client population, but also 
for new post-deployment expenses in operating them. 

Another factor: The character of client hardware, soft- 
ware and connectivity is changing rapidly, meaning it's like- 
ly that mobilized applications being written today will have 
to be rewritten or upgraded, again and again, merely to 
keep up with client-side developments. That's not a happy 
scenario for those enterprises that already see a huge back- 
log within their application development department. 

And what's the business case again? 

So, while it's laudable that the industry is working to 
create new platforms for mobility, they need to do a bet- 
ter job of simplifying the entire development, deployment 
and management stack, while narrowing the choices fac- 
ing enterprises. Otherwise, this technology's never going 
to get out of the lab. I 



21 Rules of Thumb for Delivering 



Delivering great products 
on time is a difficult but 
not impossible task. Elements 
you think would count 
the most count for very 
little. Development 
methodology, process, 
technical prowess, ex- 
cellence of tools and depth of 
project management skills all 
influence the outcome of a soft- 
ware development project; but 
nothing indicates success as 
much as the individual's ability 
to focus on a few critical and 
conceptually simple things. 
These things can be expressed 
as rules of thumb. 

I enumerate 21 of these 
rules of thumb. Pick a handful 
(or so), apply them, and your 
project will probably be more 
likely to succeed. I lump them, 
naturally enough, into three 
groups: "Shipping," "Great 
Products" and "On Time." 
(Fancy that!) I cover them in 
reverse order, because the con- 
cepts build a bit. 

By the way, a product, as 
used herein, means any object 
created as the output of pur- 
poseful effort. Whether a prod- 
uct is great (perhaps) can be 
determined only in retrospect, 
presumably by assessing the 
extent of favorable results it 
produced as measured against 
the costs its creation and use 
incurred. Since we can't know 
that in advance, I locally define 
a great product as one wherein 
the potential of its creators and 
its most obvious intended uses 
have been served. 

ON TIME 

1. Don't know what you 
don't know. It is essential not 
to profess to know, or seem to 
know, or accept that someone 
else knows, that which is 
unknown. Almost without 
exception, the things that end 



up coming back to haunt you 
are things you pretended to 
understand but didn't early on. 
At virtually every stage 
I of even the most suc- 
1 cessful software pro- 
jects, there are large 
numbers of very impor- 
tant things that are unknown. It 
is acceptable, even 
mandatory, to clearly 
articulate your igno- 
rance, so that no 
one misunderstands 
the corporate state 
of unknowingness. If 
you do not dissemi- 
nate this "lucid igno- 
rance," disaster will 
surely befall you. 

Human nature is 
such that we dislike not know- 
ing things we deem important 
to our well-being. Since there 
is so much we don't know in 
a software project, the nearly 
universal tendency among 
developers and their managers 
is to gloss over or even deny 
altogether the extent of their 
ignorance. 

You should reward and trea- 
sure those who consistently 
make themselves aware of the 
list of relevant things that are 
currently unknown. It requires 
mental and psychological 
strength to resist the normal 
human cravings for certainty and 
order. It is especially difficult to 
believe in uncertainty when 
things have a veneer of orderli- 
ness, which is often the case. 
Pseudo-order is a maladapted 
defense against uncertainty. 

The organization surround- 
ing you will undoubtedly 
abhor uncertainty, would infi- 
nitely prefer pseudo-order, and 
will make countless attempts to 
magically convert your igno- 
rance to knowledge. Your job is 
to make uncertainty an unshak- 
able fact, and to coerce the 




Authors note: This essay was first drafted in 1994, really as 
notes I made while wrestling with the idea of turning a 
talk I gave into a book. I had been presenting "21 Rules 
(The Talk)", since 1989, originally under the name "Slipping 
Without Falling/' Ultimately, from these notes a book did 
congeal in "Dynamics of Software Development," which came 
out in 1995. 

Somehow subsumed in the process was this essay, which 
apparently, someone had preserved, and which recently some- 
how showed up on the Web, where it provoked a fair bit of com- 
ment. It was never really intended for publication, and I have 
never published it anywhere that I can recall. But, once posted, 
a number of people seemed to have found it useful (or at least 
provocative). So I brushed it up a bit, changed a few of the rules, 
and now offer this updated version for your inspection. 



reshaping of the surrounding 
organization to cope with the 
uncertain situation. The organi- 
zation must learn to thrive in an 
uncertain environment for its 
own well-being. 

You should expend a great 
deal of effort making sure 
that all the people on the 
project are aware 
of their ignorance 
rather than naively 
converting it to 
falsehoods. Bear 
down on them until 
I they realize they 
I haven't comprehen- 
sively assessed the 
unknowns. In the 
successful project, 
this is much easier in 
the early stages, or during times 
of change. This is no time for 
niceties. People ultimately pre- 
fer success even if disillusion- 
ment is a prerequisite. 

2. Get to a known state 
and stay there. The function 
of QA is to know (and articu- 
late) the quality of the product 
at all times in the development 
cycle. This can be achieved by 
abbreviated, repeatable tests 
conducted daily, and full prod- 
uct sweeps conducted weekly 
or biweekly. 

It is not properly the job of 
QA to determine when a prod- 
uct is ready to ship; rather, the 
moment of shipworthiness in a 
product development cycle is 
evident to everyone involved, 
and is noncontroversial. After 
all, delivery has been the goal of 
the entire effort. Crossing the 
finish line, while it has intangi- 
ble emotional and definite 
financial rewards, is no surprise 
when you have observed every 
single painful step toward it. 

The only reason you have 
been able to make these micro- 
observations, however, is be- 
cause you got to a known state 
and stayed there. Generally, 
your QA is how you did it. 

Achieving a relatively accu- 
rate view into product status is a 
very challenging goal, requiring 
a highly motivated and compe- 
tent QA team. It is also a pre- 
requisite for success. Many 
software development organi- 
zations even at this late date 
have rudimentary or no real QA 
assets. Frankly, there is little 
that can be done for them until 
they make the appropriate 
investments in creating a mod- 
ern development organization. 
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Great Products on Time 



A known state consists of all 
components having accurate 
and accessible status informa- 
tion at a given point in time. 
You know that it's accurate 
because the status has been 
tested by QA. 

A developer articulating the 
status of his/her component is 
an exercise that does produce 
information, but if it happens to 
communicate the components 
status, it is usually an amazing 
coincidence. This is someone 
else's job. 

Status should consist of a 
comprehensive listing of tested 
and missing functionality, bug 
count sorted by severity, bug 
arrival rate, bug fix rate, pro- 
jected total bug count and oth- 
er vital metrics. 

3. Remember the trian- 
gle. There are fundamentally 
three things that you are work- 
ing with as a member of a 
development team: resources 
(people, money and things that 
cost money), product features 
(including the quality of their 
implementation) and time (pri- 
marily as expressed in a sched- 
ule). Changing one has an 
impact on at least one other 
axis, usually two. 

It is a simple enough matter 
to mentally run through the 
sides of the triangle, or force 
others to do so, when dis- 
cussing any part of it. Since the 
people, the product or the 
schedule is usually what you 
are discussing, for complete- 
ness' sake, you must constantly 
envision the triangle. This dis- 
cipline leads to the most fruit- 
ful line of thought. 

4. Don't go dark. Some 
features have long development 
lead times — months or even 
years. Yet slips usually happen a 
little bit every day, and must be 
compensated for a little every 
day. This means that the granu- 
larity of individual tasks must 
be such that deliverables are 
made at intervals sufficiently 
small that slips will surface fre- 
quently enough to be compen- 
sated for. 

Two weeks, for example, is 
typically too long a time to 
go without knowing what is 
happening on a project fea- 
ture. Team interdependency 
is also a powerful motivational 
force. Each person on the 
team can make a promise 
every week, and keep or 
change that promise (if need- 



A video of Jim McCarthy 
presenting the 21 rules to an 
audience, as well as the relat- 
ed book, "Dynamics of Soft- 
ware Development: Don't 
Flip the Bozo Bit and 53 Oth- 
er Rules of Thumb for Ship- 
ping Great Software on 
Time," are available at www 
. mccarthy-tech. com. 

ed) every week. 

If the goal of the effort is to 
ship a great product on time 
(and what else could it be?), 
and if everybody accepts that 
goal as uppermost, the chase, 
though challenging, is generally 
enjoyable. 

5. Use zero defect mile- 
stones. Organize the project 
around the concept a reaching 
milestones with zero defects. 
ZD does not mean that 
the product does not have 
bugs, or missing functionality. 
It means that the product 
achieves the quality level 
that had been set for that mile- 
stone. The product is tested to 
that effect. 

The essential point of ZD 
milestones is that nobody 
makes the milestone until 
everybody does, and nobody 
leaves it until everybody does. 
This enables the team to dis- 
cover what aspects of the pro- 
ject are in trouble. Load balanc- 
ing can occur. Awareness of 
unknowns rises. 

At a milestone, the team 
and its leadership also have the 
opportunity to perceive the 
whole project status simultane- 
ously, to draw conclusions 
about erroneous practices, to 
remedy bad design decisions 
and to reorganize for peak per- 
formance. Delivering is just 
the final milestone. Though 
the external organization cares 
most about delivering, which 
adds special pressure to that 
milestone, the team develops 
extraordinary focus and intro- 
spection about each and every 
milestone. I 

To be continued in the 
Sept. 1 issue of SD Times. 

Jim McCarthy led software 
development teams at Bell 
Labs, The Whitewater Group 
and Microsoft Corp. He is the 
author of "Dynamics of Soft- 
ware Development" and, with 
Michele McCarthy, "Software for 
Your Head. " 



Letters to the Editor 



NO LAW OF THREES 

I think Larry O'Brien needs to 
study Metcalfe's law ["Micro- 
soft's Tablet Works Right 
Away," June 15, page 35 or at 
www. sdtimes.com/cols/winwatch 
_104.htm]. It's not a law govern- 
ing the number of releases 
required to achieve a useful 
product; there is no law of threes 
here. The closest thing I have 
heard to this is stay away from 
uneven-number releases, 1.0 
sucks, 2.0 fixes it, 3.0 adds new 
stuff (that suck), 4.0 fixes that. 

Metcalfe's law simply states 
that a communication medium 
is increasingly useful as more 
people use it. 

I don't see how this applies 
to the tablet, since it's so darn 
expensive and new, few people 
have one. I don't count the use- 
less prototypes of the 1990s, as 
they really sucked. So the con- 
cept is not all that new, but 
hardware like this was not avail- 
able at that time. Microsoft did 
a good job releasing a new OS 
for a new form factor, and did it 



right on their 1.0 product. 

The success here is that I am 
not the beta guinea pig Micro- 
soft has made me in the past — 
for that they deserve credit. But 
saying that the article is an 
affront to all those who worked 
on the primitive beginnings is 
like complaining that the guys 
who made electric arc lights (or 
anyone else that researches what 
is now recognized as important 
but failed technologies) should 
get recognition for their contri- 
bution to the light bulb. 

Michael Clark 

WHAT DO YOU THINK? 

SD Times welcomes feedback. 
Letters should include the 
writer's name, company affili- 
ation and contact information. 
Letters become the property 
of BZ Media and may be edit- 
ed for space and style. 

Send your thoughts to 
feedback@bzmedia.com, or fax 
to +1-516-922-1822. Please 
mark all correspondence as 
Letters to the Editor. 



Where Are Those 
Developer Jobs Going? 
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The overwhelming number of software development projects being con- 
tracted outside the company are going to India, a new study published 
by Evans Data Corp. has revealed. 

Enterprise Development Management Issues, Summer 2004, which 
covered nations around the world, showed that nearly 30 percent of the 
316 responding companies said that India's highly educated work force 
and base of software companies have made the nation their top choice 
for application outsourcing. 

Running second at 18 percent were North American countries, which 
showed that while development services may be cheaper elsewhere, 
foreign countries still rely on North America for services they may be 
unable to find elsewhere. 

Countries in Eastern and Western Europe, Asia and the former Sovi- 
et block, despite being combined into groups, still showed usage for 
outsourcing projects in the single digits. 
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Visual Studio Developer Cnnference 

Orlando 

JW Marriott Grand Lakes Resort 
September 11 -1b r 2004 




Register Now] 

Call 800-848-5523 or visit 

www.vsl i ve/2004/OR. 

Mention priority code 

ORSDT. 




The Premier VS Developer Conference 

Returns to Florida 

Five information-packed days 
150+ hours of hard-hitting technical content 



W nether you've bEEn wnrfurg with .NET for years P ai Ere 
still migrating your VEG apps to (he .NET framework, VSIivel 
Orlando wNI delvE deeply into thesubjEcts ttiat msttEr 
tfta most — ifi-ctirdlng architecture, data access, Ul r and 
security — white higtilightirg whstis coming around the bend. 



Call 800-943-5523 or visit www.vs 1 1 ve.c Dm/2004/0 R 
and rag isle r rmw! Menliun priority code GRS0T. 



Join us atthE JW Marriott Orlando Grande Lakes Resort, 

September 11 15, and learn from the best assembly of 
sessions and speakers, as well as brnwsE an Exhibit hall 
where you can meet tfie vendors that briny you the products 
and SErvices you mly on most. 

■ GEt no-nonsensE information from independent Expert 
speaker 

■ SpEak direcdy to the Microsoft Development Team from 
HedmorcE 

■ Participate in (ull-day workshops that provide mnrE 
substanca (nan most conferences 

The fuil agenda is online now* 
Visit www,vstwc.cGm/2QQ4/0ft 



"FTP tias done b tremendous job with helping us build thE 
de^efoper community and really has become Jtre 
conference for Visual Studio Developers." 

—David La/ar r M'rcosoft Group Product Manager 






The JW Marriott Orlando Grande Lakes Resort 

Architecturally stunning and unmistakably Spanish in style, 
ttifl 1 r DD0-roQrr JW MarnortOdandc Grande Lakes is central 
Rtirida's premier destination. The reiurt features an 
innovative W.ODD-^quare-t-oatspii, a Greg Norman-designed, 
championship golf course and bnl Tandy designed meetirg 
space ensuring an experiential feast tor business, 
rn e eti n y, a nd I eis u re g u e sts alike Hi gli-s p e ed I ntemel 
access provided by ST SIM. Visit www.vs1ive.conV20D4, !, 0H 
and click Venue & Travel for details 
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Call 800-848-5523 or visit www.vslive.com/2D04/OR 
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A Little Dose of Mono 



The Mono project is a Novell-spon- 
sored, open-source implementation of 
C# and the Common Language Infra- 
structure. It runs under a number of oper- 
ating systems, most notably Linux, and 
after a good deal of scrutiny, my conclu- 
sion is that the recent 1.0 release is a 
viable option, not just for exploring C# or 
the infrastructure, but for delivering serv- 
er-side applications and for administra- 
tion- and form-based client programs. 

The Linux desktop environments and 
their APIs are new to me, so I hesitate to 
judge Mono's appropriateness for client 
programs that have complex UI needs, 
but the quality of the Mono implemen- 
tation seems so uniformly high that I 
suspect that it's not just a viable option, 
but an attractive one. 

The Mono project was initiated by 
and is led by Miguel de Icaza. 

de Icaza is one of those types who, in 
conversation, impresses not by holding 
forth, but by holding back. He doesn't 
speak up particularly often, and when 
asked about the difficulty of implementing 
a feature, he typically shrugs it off as no 
great burden. ("Any problems with gener- 
ics?" Shakes his head no. "Are anonymous 
functions hard to implement?" Slight 
smirk, shakes his head no. One suspects 
that "What about quantum computing?" 



would elicit a slight wince and, after a few 
seconds, a similar demurral.) 

The Mono project has been under 
way since 2001, and even 18 months ago, 
when I was regularly testing the several 
hundred programs in my book using it, 
the compiler was solid. The few issues I 
found (fairly classified as corner cases) 
were addressed within a mat- 
ter of weeks after submitting 
them. That's one of the great 
advantages of open-source 
processes. 

By now, the compiler and 
infrastructure seem to me to 
be stable enough to trust for 
server processes running day 
in and day out; given the rela- 
tive ease of replicating multi- 
ple Linux servers and Mono's 
integration with Apache, I think that 
teams contemplating low-cost scaling of 
dynamic Web sites or Web services ought 
to give Mono a serious evaluation. 

Although the past few years and pro- 
grams like Symantec's Ghost have made 
replicating Windows machines signifi- 
cantly easier, replicating Linux machines 
is trivial. 

Also, although Windows has 
improved its remote access and script- 
ability for administration, it's fair to say 
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that there is a far greater depth of expe- 
rience in the Unix culture for adminis- 
tering groups of machines. 

Apache is at least as trustworthy and 
dependable as Microsoft's Internet Infor- 
mation Server, bundled with Windows 
servers. I remain unconvinced that open- 
source database solutions can claim the 
same performance and relia- 
bility as commercial products, 
but I'll acknowledge that they 
suffice for many situations. 

I've had several clients be 
pleased with Linux for their 
Web-facing servers and differ- 
ent operating systems for their 
^m i Oracle or SQL Server database 

servers. (Of course, network 
topology and capacity cannot 
be ignored in such scenarios!) 
I would not hesitate to be involved in a 
project that combined such a physical 
architecture with Mono as the implemen- 
tation platform — I think it would be a 
dependable and economical way to bring 
C#, in my opinion a better solution than 
Java for enterprise development, into a 
Unix shop. 

As I said, I'm not nearly as familiar 
with Linux desktop environments and 
their related interface toolkits, so I can't 
make as confident a recommendation on 
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the use of Mono in a significant client 
application, but the first justification for 
Mono was as an offshoot to the Gnome 
Project. As far as it goes, I am building a 
Linux-based personal video recorder 
and hope to use Mono for whatever 
automation I can't put together from 
existing sources. 

C# and .NET are rightly identified as 
primarily Microsoftian. They are most 
likely to be adopted within shops that 
have chosen to use Microsoft operating 
systems and technologies in a majority, if 
not the entirety, of systems. 

However, fair-minded individuals, 
even those who for political or technical 
reasons have decided against the use of 
Microsoft operating systems, should 
acknowledge that C# and the Common 
Language Infrastructure are well 
designed and make attractive promises 
of productivity. 

Whether the ultimate platform is bet- 
ter than J2EE is something that honest 
people can disagree on. 

At the very least, with Mono, people 
will be able to judge for themselves with- 
out giving a dime to Redmond. 

At the very most, people will find a 
powerful open-source solution that is 
competitive with the best that Microsoft 
has to offer. I 

Larry O'Brien is a technology consultant 
and analyst, and the founding editor of 
Software Development Magazine. 
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Caching In on Java Caches 



There is a growing perception that 
J2EE suffers from a troubling archi- 
tectural defect: application code and 
deployment features are all mixed 
together. This is due to the need 
imposed on developers to code deploy- 
ment constraints directly into the code- 
base. There are many instances of this, 
but few as common as developers' need 
to build and manage their own caches. 

Caches are built to hold recordsets 
from database accesses, for data entered 
by users, for JSPs, for data shared with 
other applications, for Web services and 
so on. Writing usable, reliable caches is 
not trivial, but managing them can be a 
nightmare. 

Some caches need persistence and 
must not be flushed until all processing 
is complete, other caches need to be 
flushed frequently, and then, of course, 
others must be flushed at specific 
moments and in a specific order. Choos- 
ing a cache size is another problem, and 
is often determined by the developer's 
own knowledge of the resources avail- 
able on the deployment system. 

The more a developer codes to 
these constraints, the more brittle 
the application becomes and the more 
the developer is forced to do something 
not in his province: managing appli- 



cation deployment. 

When caches are hard-coded to a par- 
ticular size, critical performance bottle- 
necks are hardwired and cannot benefit. 
The application can no longer be tuned, 
and in this sense, it is inching toward 
unmanageability. 

Clusters compound this problem 
because of their need to share 
data between nodes. Two 
common problems occur here: 
sharing state information and 
sharing database records. 

The first problem, unfortu- 
nately, is often solved by using 
a database to hold state data — 
an easy, effective and com- 
pletely incorrect solution. 

The only benefits a database 
delivers are locked access and 
reliability. But all of the other work a data- 
base performs to support ACID proper- 
ties — atomicity, consistency, isolation and 
durability — and to persist data to disk 
causes a huge overhead. If the DBMS 
used for this persistence is the same one 
that stores the application's data, perfor- 
mance will be detrimentally affected. 

Even if state is shared through other 
means, clusters risk thrashing a database 
repetitively performing the same 
queries, unaware that the returned 
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recordset already exists in the cache of 
another node. 

What enterprise Java needs, then, is a 
caching mechanism that fulfills specific 
criteria, relieves pressure on the database, 
separates the caching from the application 
coding and scales well. To do this, a good 
Java cache solution needs the following 
qualities: 

• Caches must be dynamic, 
able to grow and shrink. 

• Cached data must be 
sharable between nodes. 

• Caches must not use a data- 
base to persist information. 

L • Caches must be able to 

^^^ monitor the database and 
invalidate recordsets they're 
holding. 

• They must be manageable 
by the system administrator/manager. 

• They must be easy for developers to use. 
Few offerings come close to meeting 
those requirements. The baseline solu- 
tion today is JCache, which is an open- 
source implementation of the JCP's JSR 
107. It removes many of the headaches of 
writing a cache and intimately managing 
its operations. However, JCache does not 
directly support caching between all 
nodes on a cluster, nor does it do anything 
to monitor freshness of recordsets 
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extracted from a database. 

Vendors are starting to respond. 
BEA's WebSphere and IBM's WebLogic 
offer caching add-ons that solve some of 
the problems. Tangosol and Spirits oft 
are also working on these issues. 

SpiritSoft, you might recall, formerly 
specialized in Java Message Service 
products targeted at banking and finan- 
cial services markets. Later, SpiritSoft 
started going after the caching problem. 
It implemented JCache and added JMS 
as a message transport system for push- 
ing updates. It then leased caching 
patents from Persistence, the vendor of 
the well-regarded but little-sold Power- 
Tier app server. 

Today, SpiritSoft is coming close to 
the type of cache that enterprise Java 
apps need. It already is working on the 
problem of invalidating cached database 
records by monitoring the DBMS; that 
product is scheduled to ship toward the 
end of the year. Several start-ups also are 
pursuing similar technology, but they 
have not yet released products. 

Caching will likely become another 
of the technologies absorbed into the 
J2EE specification. However, it will 
remain one of the features by which 
vendors will be able to truly distinguish 
themselves, both as to capabilities and 
performance. I 

Andrew Binstock is the principal analyst 
at Pacific Data Works LLC. 



From JavaOne to JavaOne-Half 



The most interesting thing about this 
year's JavaOne was that it wasn't — 
interesting, that is. Over the years, the 
conference has gone from one of the 
best technical conferences that I've ever 
attended (in 1996, if I remember right) 
to one of the most vapid. 

Admittedly, as the platform matures 
there are fewer wowie-zowie features to 
discuss, but most of this conference just 
rehashed the new features of Java 5 (for- 
merly known as 1.5) — material that was 
covered last year in sessions that used 
the same slides as this year's sessions. 
You come away from a great conference 
knowing how to do new things and hav- 
ing lots of new ideas. I came away from 
this year's JavaOne ready for a vacation. 

SD Times' editor-in-chief, Alan 
Zeichick, came up with an interesting 
characterization of the problem: The 
goal of a technical conference should be 
to educate, not to influence or persuade 
developers. 

The context for Alan's comment was 
Microsoft's recent developer conferences, 
but his comment applies to JavaOne as 
well, which has developed a very 
Microsoft-like flavor of late. The main 
goal of this year's JavaOne seemed to be 
to convince attendees that Sun, and 
Java, were relevant. I don't need to be 
convinced that Java is relevant, but 



Sun's relevance is another issue. 

The first JavaOne was so good because 
it was focused entirely on education, on 
learning to program in Java. I came away 
from the conference eager to apply what I 
had learned, and I had learned a lot. 

I vividly remember a session on the 
Abstract Window Toolkit (AWT), for 
example, where the speaker analyzed the 
library in terms of the imple- 
mented design patterns and 
showed how the APIs fit into 
those patterns. The APIs were 
put into a context that allowed 
me to understand the whole 
library, including those APIs 
that were not discussed durin 
this session. The talk, which 
didn't follow a rigid format, 
was packed with information. I 
came out of this session thor- 
oughly understanding AWT and its archi- 
tecture, and could immediately apply 
what I'd learned. 

By contrast, this year I listened to 
somebody droning on for an hour about 
a list of APIs, with no attempt to describe 
the overall architecture and design con- 
siderations of the subsystem. Mix in a 
heavy-enough accent so that you under- 
stand only half the words, a pace so slow 
that it puts you to sleep and no real code 
examples, and you'll understand the 




depth to which the conference has fallen. 

So, how to fix things? 

First, Sun has to eliminate marketing 
sessions entirely. (It could start by elimi- 
nating the all-morning keynote address- 
es, which have degraded to feel-good 
propaganda sessions.) The session-selec- 
tion criteria should be determined by 
programmers. 

Sun should ask the user 
I community, "What are you 

r working on, and what pro- 
gramming problems are you 
encountering?" and then 
develop sessions to address 
those problems, to help pro- 
grammers write programs. I 
don't want to be convinced 
that some technology is 
good. I want to learn some- 
thing useful. 
Next, pick the presenters carefully. 
Most sessions I attended were presented 
by people who were undoubtedly good 
engineers, but were lousy speakers and 
incompetent educators. Presenting tech- 
nical material is a skill that takes serious 
practice to develop. Sun should either 
pick competent people from outside the 
organization to do its presenting (and pay 
them well — speakers at JavaOne current- 
ly are not paid at all), or it should train its 
own engineers to be good presenters. 
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Also, Sun forces presenters to create 
slides that conform to rigid templates and 
formulas. These formulas have to go. 
Speakers are required, for example, to 
talk about what they're going to talk 
about, talk about it, then talk about what 
they talked about. This formula is rarely 
followed by good educators. There's a dif- 
ference between a "presentation" and a 
true classroom session. 

Finally, lock the lawyers in a closet. 
I'm guessing that all presentations are 
reviewed by Sun's lawyers, who do their 
best to turn content into garbage. 

Someone, for example, has decided 
that "Java" always must be used as an 
adjective, not a noun, to protect Sun's 
trademark. Imagine that instead of say- 
ing, "Things go better with Coke," you'd 
have to say, "Things go better with the 
Coca-Cola™ brand beverage." This rule 
leads to ridiculous stuff like: "Building 
Peer-to-Peer Java Technology-Based 
Applications With JXTA™ Networking 
Technology," which isn't even English. 
What is a "technology-based" applica- 
tion anyway? And yes, that's a real class. 

You get the idea. JavaOne was once a 
great conference. It could be great 
again. To get there, however, Sun needs 
to wrest the conference away from the 
marketing department and give it back 
to the engineers and educators. I 

Allen Holub is an architect, consultant 
and instructor in C/C++, Java and OO 
Design. Reach him at www.holub.com. 
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The Once and Future Kings 
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The phrase "The Once and Future 
King" has been used in many con- 
texts, but is arguably best known as a title 
of a collection of books about the mythi- 
cal King Arthur. Written by T.H. White in 
the 1950s, those books have nothing to do 
whatsoever with software development. 

Yet that title is fitting as a collective 
description of software developers. For 
a two-decade period, from 
the early 1980s through the 
end of the 1990s, program- 
mers were universally the fair- 
haired children not only of 
the computer industry, but 
also of the global Fortune 
2000. Those brilliant and 
essential individuals were 
pampered and adored, their 
eccentricities valued, their 
character flaws revered. 

A good systems analyst, 
architect or coding god (or goddess) was 
hard to find. They knew it. They 
received, often without asking, huge 
salaries, generous stock-option grants 
and signing bonuses, and waivers from 
nearly every human-resources best prac- 
tice. They could come and go whenever 
they wanted, sleep at their desk, bring 
their dogs to the office, play Foosball, 
park their Lamborghinis in the lobby, 
drink Jolt cola, go on sabbatical after two 
years, and forget to bathe or change 
clothes. As long as they kept crankin' out 
that golden code, there were no rules. 

The developer was king. Whether in 
Silicon Valley, on Route 128 or in other 
clusters, it was a golden age. It was, in a 
word, nerdvana, forever captured in 
early Dilbert cartoons and piles of 
unwashed product-launch T-shirts. 

In fact, many of the corporate cultural 
changes initially put in place to encour- 
age software developers (and their col- 
leagues, the hardware engineers) began 
to migrate outside of the IT department. 
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Foosball tables, fridges full of free soft 
drinks and company masseuses spread 
throughout different industries. While it 
seemed that venture-funded start-ups on 
the fast track to an IPO had the most gen- 
erous culture, competition dictated that 
even old-economy firms had to loosen up 
beyond dress-down Fridays. 

POP GOES THE BUBBLE 

Then the recession hap- 
pened. Stock options evapo- 
rated, companies closed. The 
well of IPOs and easy venture 
money dried up. VCs, stock 
analysts and entrepreneurs 
would no longer tolerate the 
excess head count and 
employee perks. We saw the 
Foosball table be sublet to 
another tenant, the free- 
drink fridge be replaced by a vending 
machine, the sign-up bonuses disappear. 
Suddenly, developers were mortal. 
No longer king, they had to wash their 
shirts. They had to show up at meetings. 
Forget about stock options — they had 
to keep their jobs. Even so, there were 
layoffs for many, and less generous com- 
pensation for the survivors. Never mind 
the purple of royalty; they were just 
ordinary white-collar workers, even if 
the white collar was a Beefy-T. 

That was just the first round. The 
spectre of off shoring is causing CEOs 
and CFOs to re-examine their staffing 
policies, with developers in California 
and Massachusetts competing salary-wise 
against those in India, China and Russia. 
Suddenly, the rock-climbing walls and 
sabbaticals seem a vague memory from 
the late Cretaceous period. 
Or are they? 

There are signs and portents of resur- 
rection of the high-tech economy. They're 
subtle and may simply be a false alarm, 
but the signs are there nonetheless. The 



long-awaited initial public offering of 
Google, for example, is coming, and the 
company set an extremely optimistic price 
target for its stock that would value them 
between US$29 and $36 billion. Then 
there's Salesforce.com, which announced 
its own IPO with a more earthly market 
cap of US$1.2 billion. 

Both Google and Salesforce are dot- 
coms. Does that mean the dot-com era is 
coming back, that your CEO should 
order more Foosball tables? Is the devel- 
oper about to become king once more? 

STILL POPPED 

The dynamics have changed, not only in 
business but in the way that software is 
developed. That so many talented out-of- 
work individuals are now willing to put on 
clean blue jeans and brown-bag their 
lunch means the culture of developer- 
worship will never return, at least not to 
the same extent. 

Developers are mortal. Or so they 
now know. Their colleagues, managers, 
executives, venture capitalists and the 
stock market know that too. 

But that doesn't mean that developers 
are doomed to a life of soggy tuna-fish 
sandwiches instead of filet mignon at the 
company cafeteria. 

The team of programmers who 
slogged through a death-march project to 
bring an EDI system online with Wal- 
Mart, or who set up a company's migra- 
tion from mainframes to Linux clusters 
running J2EE app servers, or who creat- 
ed Web-based interfaces to a company's 
20 different apps will always be impor- 
tant. Someday that will be revered again. 
They just won't be as revered as they 
used to be, and they may never see the 
return of the get- rich IPO. 

Overall, as we ponder the fate of our 
once and future kings — and queens — of 
software development, that's ultimately 
a healthier situation to live in. I 

Alan Zeichick is editor-in-chief of 
SD Times. David Rubinstein is enjoying 
a dot-com-era sabbatical 
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IBM Corp. has signed a definitive agreement to acquire Alphablox Corp. for an 

undisclosed sum. Software from Alphablox, a privately held analytics software devel- 
oper based in Mountain View, Calif., can be used to embed analysis logic, such as to 
identify buying trends, into existing applications or processes, and make that infor- 
mation available across an enterprise. IBM will use the technology to fortify the busi- 
ness intelligence offerings of its data management solutions division . . . Veritas 
Software Corp., which develops data protection, storage and management solu- 
tions, has acquired Invio Software Inc., a privately held process automation tools 
vendor based in Los Altos, Calif. The all-cash deal, valued at US$25 million, enables 
Veritas to own Invio technology that was already an integral component in some of 
its products. 

EARNINGS: Apple Computer Inc. posted a net profit of US$61 million, or 16 
cents per diluted share, for its fiscal 2004 third quarter that ended June 26. The 
results were up significantly from the same period last year, during which the com- 
pany reported a net profit of $19 million, or 5 cents per share. Apple's revenues for 
the quarter were just over $2 billion, an increase of 30 percent from the year-ago 
period . . . Intel Corp. has announced second-quarter revenues of US$8.05 billion, 



an 18 percent increase from the same period last year, but flat compared with the 
previous quarter. Net income for the quarter was $1.8 billion, or 27 cents per share, 
an increase of 96 percent from the 14 cents per share of a year ago . . . Microsoft 
Corp., flush with cash, has approved an 8-cents-per-share quarterly dividend. It will 
also buy back US$30 billion in stock over the next four years, as well as offer a spe- 
cial one-time dividend of $3 per share. The company figures the total return to 
shareholders as being $75 billion over the next four years . . . Cell-phone chip mak- 
er Qualcomm Inc. posted revenues of US$1.3 billion for its fiscal third quarter end- 
ed June 27, a 50 percent increase from a year ago, and an increase of 10 percent 
sequentially . . . Integration software vendor Ascential Software Corp. announced 
second-quarter results showing net income of US$1.2 million, or 2 cents per diluted 
share, on $64.7 million in revenues, an increase of 62 percent from a year ago . . . 
EMC Corp., parent company of virtual operating system developer VMWare Soft- 
ware, reported second-quarter revenues of US$1.97 billion, up 33 percent from year- 
ago earnings of $1.48 billion. Net income for the quarter was $193 million, or 8 cents 
per diluted share, a 136 percent increase from the year-ago period. For its part, 
VMWare contributed $47,198 in revenues for the second quarter and $39,294 for the 
first quarter. I 



CALENDAR ftF EVENT* 



HP World 
Conference & Expo 

Chicago 
INTEREX 
www.hpworld.com 



Aug. 16-20 



Embedded Software Aug. 17-19 
Development Conference 

San Jose 

BZ MEDIA LLC 

www.esdevcon.com 

FileMaker Developer Aug. 29-Sept. 1 
Conference 

Phoenix 

ADVISOR MEDIA INC. 

advisorevents.com/Event/CFF0408 

Intel Developer Forum Sept. 7-9 
San Francisco 
INTEL CORP. 
www.intel.com/idf/us/fall2004/systems 



Borland Conference 

San Jose 

BORLAND SOFTWARE CORP. 

info.borland.com/conf2004 



Sept. 11-15 



VSLive Orlando Sept. 11-15 

Orlando, Fla. 

FAWCETTE TECHNICAL PUBLICATIONS INC. 

www.ftponline.com/conferences 

/vslive/2004/or 



Embedded Systems 
Conference 

Boston 

CMP MEDIA LLC 

www.esconline.com/boston 



Sept. 13-16 



SunNetwork 

San Francisco 

SUN MICROSYSTEMS INC. 

www.sun.com/sncsf2004 



Sept. 14-16 



International Function Sept. 19-24 
Point Users Group 
Annual Conference 

San Diego 

IFPUG 

www.ifpug.org/conferences/annual.htm 



SD Best Practices 
Conference & Expo 

Boston 

CMP MEDIA LLC 

www.sdexpo.com 



Sept. 20-23 



IBM DB2 Information Sept. 20-24 
Management Technical Conference 

Las Vegas 
IBM CORP. 
www.ibm.com/services/learning/conf/us 

Software Sept. 22-23 

Business 2004 

San Francisco 

SOFTWARE BUSINESS MAGAZINE 

www.softwarebusinessonline.com 

Access-VB-SQL Sept. 29-0ct. 3 
Advisor Live 

Las Vegas 

ADVISOR MEDIA INC. 

advisorevents.com/CMB0409p.nsf 

For a more complete calendar of U.S. software devel- 
opment events, see www.bzmedia.com/calendar. 

Information is subject to change. Send news about 
upcoming events to events@bzmedia.com. 



Software Development Times (ISSN #1528-1965, USPS #001-9625) is published 24 times a year by BZ Media LLC, 2 East Main Street, Oyster Bay, NY 11771. Periodicals postage paid at 
Oyster Bay, NY and additional offices. POSTMASTER: Send address changes to SD Times, 2 East Main Street, Oyster Bay, NY 11771. SD Times is a registered trademark of BZ Media LLC. 



Improve Your Process, Start Testing Now 

Special offer for SD Times readers: 
10% discount with rebate code SDTM0804. Valid until 09/30/2004 

Get your free trial at www.automatedqa.com\down loads 



Award Winning Testing Solutions 



L 



TestComplete 

- AutomatedQA'$ TeslComplete is a great aroduct and j jst as capable as the .manet 
leader at less friar are-tenth "Jie pnee Why wcjld anyttdy pay S600D per sea" tar 
:as1 automataon?- 

Joel Spolsky 



* GUI Tcs-irg 

■ Un I Tes:irg 

» Regress or Tcslhg 

* FuncLoral Testing 

■ Load Teat ng 

■ Districted 'estinc, 

■ 'A'f d "fistmc 

■ Data-Driven Tes"jrg 

■ Ohjed-Driven Testing 



■ 
I 
I 
I 
I 
I 
I 
J. 




r 
i 

i 

i 



Performance and Memory 
Profiling 



AQtime 



k. 



■ Manac,Ec7Lhmanaged Applications 

* Perfor—anoe Analysis 
» Test Coverage 

* Memory Analysis 

■ Line- eve Precision 

■ Microsoft Visual Studio NET 
Integ^Jon 



I 
I 
I 

I 




Issue Tracking and Project 
Ma nag mem 



AQdevTeam 



J Wl 



» Configurable KtarkFous 

* Configurable Fields 
» Configurable Ferns 

* Scnptab e Mac r as 
■ Email Medications 

* Web Interface 
Windows Interface 



SD Times 



2004 



100 




nl. ■ ■ kJi 




Build Automation and Release 
ManagaiBHt 



Automated 
Build Studio 

V-sual Macro Builder 
Extensile Actions 
&chedu ec Bu ids 
Test integration 
ssue Track ng Integration 
Microsoft Visual StJd.o NET 
rtegratar 




T 
I 

I 







REAPERS' 
CHOKC 

AWARD 



I**!**** 




flutoTnatedQfi 

www, automated qa ,com 



(702)891-9424 

All AutamBtodGA products Indudea 60 day meruy-baefc guarantee 



the Oracle Platform 



Database lOg 
Application Server 10g 



Common LDAP directory 
Unified security model 



Common administration 



Automated space management 



Engineered to work together 




oracle.com/pldtfoTm 
orcalll.800.633.0753 



n:i: Y -ifhi e z™, Qrj(]t coipwjiio* £■ right* *tt*r**d r>Kj# ii i rvfi wiri !i**«*fc tf Or*c*i Co^flwk:" m*« in imimtt, 



